We have created our own Eventgen app which holds sample data and the
eventgen.conf file. Looking at Splunk's Eventgen documentation, is it not entirely clear where such an app needs to reside in a distributed deployment with multiple clustered search heads and indexers.
From our testing it looks like any one indexer would be the correct choice, however we would like to get confirmation on that.
FYI, we are planning to deploy our eventgen app in a mode that does not require Splunk authentication, ie. by setting
Note: this question is about version 4 of Splunk's Eventgen.
Yes, eventgen app should be deployed on the indexer tier in a distributed environment.
Hope this helps. Thanks!
In any distributed Splunk environment in general and in a clustered one in particular, it will be best to install eventgen and relevant apps with
evetgen.conf only on the Heavy Forwarder and send the generated data to Indexer layer.
here are some of the reasons as of why not install on indexer/s:
1. if it is a distributed search (not clustered) it will cause indexer imbalance due to extra load on a single indexer
2. installing evengen on all indexers will carry load on all indexers as well as impact licensing
3. minor changes or simply not paying attention and forgetting to remove
eventgen.conf from TAs on indexers will cause eventgen to generate fake data and mix it with real important data
4. control of your
inputs.conf for each indexer and a need for an updated
indexes.conf to match relevant "fake eventgen data"
why install eventgen on the Heavy Forwarder?
1. single splunk instance to test and verify results in
2. single control on eventgen configurations
3. ability to decide where and when to send the data
4. controlling only
inputs.conf and leaving
indexes.conf at indexer layer, helps in preventing data mixup
hope that clarifies it