All Apps and Add-ons
Highlighted

Search Activity App - Plans to migrate to DM and SHC support ?

Path Finder

Liked you app but cannot use on my SHC environments.

Do you plan to move to DM with acceleration ?
When we´ll have SHC support ?

Highlighted

Re: Search Activity App - Plans to migrate to DM and SHC support ?

Motivator

Unfortunately, because the app relies on a search to populate TSIDX rather than raw events, it isn't a good candidate for data models. (Would that it were!)

My general recommendation would be to install it on your DMC (Distributed Management Console) server. The DMC also needs to be installed on a box outside of the cluster, and fulfills similar roles. You should be forwarding logs from your SHC members to the indexers, so you can install it wherever you want. The large beta customer for the app has something like 12 different search heads across the organization. By installing this app on one server, they can get visibility across all their search heads. A Splunk-internal installation of the app pulls in data from something like 30 or 40 search heads, at which point some of the graphs become a little silly, but overall the system works well!

Does that sound viable for your environment? There are certainly approaches you could take to deploy the app on a SHC member (without benefiting from the HA of SHC), but for most customers it makes more sense to leverage the forwarding of logs and install on an admin box.

0 Karma
Highlighted

Re: Search Activity App - Plans to migrate to DM and SHC support ?

Motivator

I've had a few new requests to support a SHC installation. If you feel that you need this in order to be successful, please let me know!

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.