All Apps and Add-ons

Why install Cisco Networks Add-on for Splunk Enterprise to an indexer?

andyfromoz
Explorer

In our Splunk Enterprise environment we log our Cisco IOS events to a dedicated Syslog server.

The architecture is the Syslog server is just a universal forwarder that performs input processing. Events are then sent to dedicated heavy forwarders for the domain which perform the parsing process. The heavy forwarders then send off the events to the Indexers.

Deployment of 99.9% of the add-ons we have downloaded from Splunkbase get installed to the heavy forwarder and the search heads.

My question is why the install instruction for TA-Cisco_ios say install on the Indexer and don't install on forwarders?
For this TA which confs / parameters in the conf indicate this TA needs to be installed on an indexer?
Is it because people are just sending stuff directly from a universal forwarder to an indexer without a HF in between?

I have gone through the TA thoroughly and am still struggle to find any setting that in the TA that performs any index time things
I am happy to be corrected as we all come in here to learn.

Current environment is Splunk 6.6 but would have posted same question when on 6.3 if time had permitted

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

There is a limits.conf config file in the TA that would need to go on the indexers, and this relates to adjusting memory limits for lookups. But other then this, your statement is correct, since there are not any real index time operations, this can go on the HF/Aggregation Tier instead of the indexers..

View solution in original post

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

There is a limits.conf config file in the TA that would need to go on the indexers, and this relates to adjusting memory limits for lookups. But other then this, your statement is correct, since there are not any real index time operations, this can go on the HF/Aggregation Tier instead of the indexers..

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...