Deployment Architecture

App from single-instance to distributed deployment architecture.

ajain_mi
Explorer

Hi,
I already have splunk app (used splunk JDK for development) which runs fine on single-instance splunk.
I want to make my app compatible for distributed architecture. How can i proceed? Is there a proper documentation for this?

0 Karma
1 Solution

DavidHourani
Super Champion

Hi @ajain_mi,

There is no official document for this as that would really depend on your app and what it does.

Based on whether you've built a DA, TA, SA your app will simply have to go on different components of the distributed environment.

If for example it's an app for collecting data then you'll have to include it on your Heavy Forwaders; if it's a visualization or dashboard app then you need to have it on your SH, etc..

Let me know if that helps or if you need further details.

Cheers,
David

View solution in original post

0 Karma

DavidHourani
Super Champion

Hi @ajain_mi,

There is no official document for this as that would really depend on your app and what it does.

Based on whether you've built a DA, TA, SA your app will simply have to go on different components of the distributed environment.

If for example it's an app for collecting data then you'll have to include it on your Heavy Forwaders; if it's a visualization or dashboard app then you need to have it on your SH, etc..

Let me know if that helps or if you need further details.

Cheers,
David

0 Karma

ajain_mi
Explorer

Thanks, @DavidHourani.
My app does both things it collects data as well as visualize that data.
But I want different things to happen in different places like Forwarder pushing data, Indexer creating indexes and storing the data etc. In short, I want to make my app compatible with distributed deployment.
I used Splunk packaging toolkit (http://dev.splunk.com/view/packaging-toolkit/SP-CAAAE9V#required) to divide my app but that didn't work.

0 Karma

DavidHourani
Super Champion

@ajain_mi,

In that case you just need to split your app into a TA for forwarding and field extraction and an app that contains the dashboards and index definition for indexers and search heads. Then use the documentation to describe what goes where. That's the simplest way to go about it imo.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...