What's the difference between kafka messaging modular input and Splunk add on for kafka?

[saranya_fmr]

1. What's the difference between the two?

I understand both index data into Splunk.

1. N where can I find documentation for configuring Kafka messaging modular input? Is it configured on the HF that's installed on the Kafka broker or Splunk SH ?

Can I have it on a SH cluster ?

1. I was trying to configure Kafka messaging modular input on a standalone HF and there were two inputs a. STDOUT b. HEC I think hec I generate a token on a HF and configure inputs etc which I understand. STDOUT refers to what? Where are Logs are dumped ?

[sloshburch]

Difference is author and support model:

• Kafka Messaging Modular Input is written by the amazing Damien Dallimore and is Community Supported
• Splunk Add-on for Kafka is written by Splunk and is Splunk Supported

Documentation, if available, is linked to from the app's respective Overview or Details tabs.

Now, keep in mind that a Modular Input currently only scales vertically and will not work on a Search Head Cluster. So, it is recommended to have a Data Collection Heavy Forwarder where such things can run. If you'd like an even more scalable solution, then you should consider using the HEC to send the data to Splunk because then you can more easily horizontally scale the data collection. The blog post Splunking Kafka At Scale goes into rich detail.