Splunk Dev

Where to create custom app?

patelmc
Explorer

I am not using deployment server in our environment yet. I have non-clustered search head and three indexers. If I want to create custom app where should I create it. on search head server or app server (indexer)?

I have same setup in A side (primary) and B side (standby). Both active - active.
A side - one search head and three app servers (indexers).
B side - one search head and three app servers (indexers).

I know this will consume double license but that's the requirement.

Tags (1)
0 Karma

diogofgm
SplunkTrust
SplunkTrust

It will depend on the functionality of the app you want to create.

Example:
If it contains knowledge objects (views/dashboards, reports, alerts, etc.) it should go in the search head.
If it contains index time operations (e.g. data routing, anonymization, etc) it should go into Indexers/heavy forwarder

Check Splunk's guide to app development:
http://dev.splunk.com/view/SP-CAAAFD7#createapp

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Where the app goes depends on what the app does. Apps that will contain search-time objects like dashboards, alerts, and reports go on search heads. Apps that contain index-time properties for processing events (props.conf and transforms.conf) go on indexers. Apps that define inputs should go on forwarders.

Wherever you put the app, you will have to copy it to the opposite manually, of course.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...