Archive

scripted inputs best practices?

bfaber
Communicator

Are there any best practices regarding where a scripted input should run? Is there a benefit in using an intermediate forwarder to run really intensive scripted inputs?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

If the scripted input is really intensive, I would suggest it to run on Heavy forwarders. If ran on SH, it would consume user resources and if ran on Indexers, it's data would only be available on the indexer where it ran and would fail the purpose of distributed configuration.

View solution in original post

dcarmack_splunk
Splunk Employee
Splunk Employee

What is the scripted input doing?

0 Karma

somesoni2
Revered Legend

If the scripted input is really intensive, I would suggest it to run on Heavy forwarders. If ran on SH, it would consume user resources and if ran on Indexers, it's data would only be available on the indexer where it ran and would fail the purpose of distributed configuration.

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!