Splunk DB Connect and Search Head Pooling?


Hola, I recently migrated our Splunk ecosystem from a single standalone instance to 3 clustered indexers with 1 master, and 1 search head in a search head pooling configuration. We're using search head pooling to alleviate any potential performance issues down the road where we may need to quickly expand our search capabilities.

Anyway, everything has gone great however I have no idea how I'm suppose to deploy and configure the Splunk DB Connect application. I was thinking I would place it in master-apps on the cluster master and push it out to all the indexers, and then configure one input that way, but the documentation leads me to believe that this is not possible:


"Splunk DB Connect does not currently support Splunk's search head pooling functionality. To run DB Connect, you must install it on a standalone Splunk instance or on a separate search head that is not a member of a pool."

Do we really have to install another search head to use DB Connect, or is there another way?

Splunk Employee
Splunk Employee


we've just released DB Connect 1.1, which can now be installed on a search head pool.


search head pooling docs


Splunk Employee
Splunk Employee

the specifics of why DB Connect doesn't support search head pooling are described here:

0 Karma