I have index clustering setup which comprises of 1 index master and 2 index peers. NOw I want to add jmta add on modular for index clustering.
I extracted the jms modular zip file in $splunkhome/etc/master-apps and validated the bundle and restarted the splunk. It is not showing the "jms messaging" input in Datainput. And shows below error
Unable to initialize modular input "jms" defined inside the app "jms_ta": Unable to locate suitable script for introspection.
Can somebody suggest how do install jms-messaging-modular input in index clustering so that it can be pushed to index peers and it is visible in data input?
Have you tried manually install app on index nodes? And use files from master-apps for configuration only.
If I manually install app in index nodes in $splunk_home/etc/apps directory , i am sure it will show the add on in setting-->DataInputs.
An the error message I mentioned is showing in Master Index splunk web UI.
My question is , If manually install apps in index peers , will the data pulled by this add on will be clustered?
Also is there any different procedure has to be followed for insalling add on in index clustering?
Also this is not an app. it is add on which pull the message queues from active mq servers.
You can set up your cluster so that all the peer nodes ingest external data. This is the most common scenario. You do this simply by configuring inputs on each peer node. However, you can also set up the cluster so that only a subset of the peer nodes ingest data. No matter how you disperse your inputs across the cluster, all the peer nodes can, and likely will, also store replicated data. The master determines, on a bucket-by-bucket basis, which peer nodes will get replicated data. You cannot configure this, except in the case of multisite clustering, where you can specify the number of copies of data that each site's set of peers receives.
In a distributed environment I would install the JMS Mod Input on a Forwarder instance.
In this case, it may be worth to install a separate Splunk server and use it only for modular inputs that do not support or are not designed for clustering, so as not to lose the opportunity to configure them via a web interface?
Here is what I have done. I distributed the add on jmsmessaginginput modular from master index to peer indexing and whr it was pushed in $splunkhome/etc/slave-apps directory and i could show in the apps section in web UI/ But since i could not see the add on in Data inputs , i copied the whole bundle to $splunkhome/etc/apps directory and restarted the splunkd . And I was able to see the add on.
I am not sure it is the right way , now it has to be tested the correct way.
Frankly speaking there is no proper documentation for adding modular input for indexing cluster.