Deployment Architecture

App from single-instance to distributed deployment architecture.

ajain_mi
Explorer

Hi,
I already have splunk app (used splunk JDK for development) which runs fine on single-instance splunk.
I want to make my app compatible for distributed architecture. How can i proceed? Is there a proper documentation for this?

0 Karma
1 Solution

DavidHourani
Super Champion

Hi @ajain_mi,

There is no official document for this as that would really depend on your app and what it does.

Based on whether you've built a DA, TA, SA your app will simply have to go on different components of the distributed environment.

If for example it's an app for collecting data then you'll have to include it on your Heavy Forwaders; if it's a visualization or dashboard app then you need to have it on your SH, etc..

Let me know if that helps or if you need further details.

Cheers,
David

View solution in original post

0 Karma

DavidHourani
Super Champion

Hi @ajain_mi,

There is no official document for this as that would really depend on your app and what it does.

Based on whether you've built a DA, TA, SA your app will simply have to go on different components of the distributed environment.

If for example it's an app for collecting data then you'll have to include it on your Heavy Forwaders; if it's a visualization or dashboard app then you need to have it on your SH, etc..

Let me know if that helps or if you need further details.

Cheers,
David

0 Karma

ajain_mi
Explorer

Thanks, @DavidHourani.
My app does both things it collects data as well as visualize that data.
But I want different things to happen in different places like Forwarder pushing data, Indexer creating indexes and storing the data etc. In short, I want to make my app compatible with distributed deployment.
I used Splunk packaging toolkit (http://dev.splunk.com/view/packaging-toolkit/SP-CAAAE9V#required) to divide my app but that didn't work.

0 Karma

DavidHourani
Super Champion

@ajain_mi,

In that case you just need to split your app into a TA for forwarding and field extraction and an app that contains the dashboards and index definition for indexers and search heads. Then use the documentation to describe what goes where. That's the simplest way to go about it imo.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...