All Apps and Add-ons

What's the difference between kafka messaging modular input and Splunk add on for kafka?

  1. What's the difference between the two?

I understand both index data into Splunk.

  1. N where can I find documentation for configuring Kafka messaging modular input? Is it configured on the HF that's installed on the Kafka broker or Splunk SH ?

Can I have it on a SH cluster ?

  1. I was trying to configure Kafka messaging modular input on a standalone HF and there were two inputs a. STDOUT b. HEC I think hec I generate a token on a HF and configure inputs etc which I understand. STDOUT refers to what? Where are Logs are dumped ?
0 Karma

Ultra Champion

Difference is author and support model:

Documentation, if available, is linked to from the app's respective Overview or Details tabs.

Now, keep in mind that a Modular Input currently only scales vertically and will not work on a Search Head Cluster. So, it is recommended to have a Data Collection Heavy Forwarder where such things can run. If you'd like an even more scalable solution, then you should consider using the HEC to send the data to Splunk because then you can more easily horizontally scale the data collection. The blog post Splunking Kafka At Scale goes into rich detail.