All Apps and Add-ons

Why install Cisco Networks Add-on for Splunk Enterprise to an indexer?

andyfromoz
Explorer

In our Splunk Enterprise environment we log our Cisco IOS events to a dedicated Syslog server.

The architecture is the Syslog server is just a universal forwarder that performs input processing. Events are then sent to dedicated heavy forwarders for the domain which perform the parsing process. The heavy forwarders then send off the events to the Indexers.

Deployment of 99.9% of the add-ons we have downloaded from Splunkbase get installed to the heavy forwarder and the search heads.

My question is why the install instruction for TA-Cisco_ios say install on the Indexer and don't install on forwarders?
For this TA which confs / parameters in the conf indicate this TA needs to be installed on an indexer?
Is it because people are just sending stuff directly from a universal forwarder to an indexer without a HF in between?

I have gone through the TA thoroughly and am still struggle to find any setting that in the TA that performs any index time things
I am happy to be corrected as we all come in here to learn.

Current environment is Splunk 6.6 but would have posted same question when on 6.3 if time had permitted

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

There is a limits.conf config file in the TA that would need to go on the indexers, and this relates to adjusting memory limits for lookups. But other then this, your statement is correct, since there are not any real index time operations, this can go on the HF/Aggregation Tier instead of the indexers..

View solution in original post

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

There is a limits.conf config file in the TA that would need to go on the indexers, and this relates to adjusting memory limits for lookups. But other then this, your statement is correct, since there are not any real index time operations, this can go on the HF/Aggregation Tier instead of the indexers..

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...