Archive
Highlighted

scripted inputs best practices?

Communicator

Are there any best practices regarding where a scripted input should run? Is there a benefit in using an intermediate forwarder to run really intensive scripted inputs?

Tags (1)
0 Karma
Highlighted

Re: scripted inputs best practices?

SplunkTrust
SplunkTrust

If the scripted input is really intensive, I would suggest it to run on Heavy forwarders. If ran on SH, it would consume user resources and if ran on Indexers, it's data would only be available on the indexer where it ran and would fail the purpose of distributed configuration.

View solution in original post

Highlighted

Re: scripted inputs best practices?

Splunk Employee
Splunk Employee

What is the scripted input doing?

0 Karma