Deployment Architecture

Do we need to install all apps for indexers in cluster ?

AKG1_old1
Builder

Hello,

We are planning to move from Single instance installation to cluster(1SH + 3 INDEXER)

we have 50+ supporting apps downloaded from splunkbase. We use one primary app which has all the main configuration like props, transform, dashboards, datamodels etc. we will be distributing this primary app to indexer using configuration bundle.

I wanted to know if we need to push all other supporting appls like Lookup Editor, Calender_App etc ?
As per my understanding these supporting app/add-on only be used on search head. so do I need to push these to all indexer ?

example:

2020-10-13 15_58_44-apps - autoengine@hp737srv - WinSCP.png

Thanks

 

 

 

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @AKG1_old1.,

you can see in apps.splunk.com and check, one by one, in the documentation section of each app, if there's an Indexer component.

Anyway, I'd install on Indexers all the TAs.

Ciao.

Giuseppe

P.S.: if this answer solves your needs, please accept it for the other people of Community and Karma Points are appreciated 😉

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @AKG1_old1,

if you're speaking of apps like  Lookup Editor, Calender_App, etc, in other words apps only for presentation, you don't need to install them on Indexers.

It's a different thing for the TAs, especially the ones required by some special App, e.g. the Splunk App for windows Infrastructure requires TA_Windows, Splunk Add-On for Microsoft Active Directory, Splunk Add-On for Microsoft DNS, etc...

In other words you have to see in the documentation if there are Indexes components.

All these apps must be deployed by the Master Node.

Ciao.

Giuseppe

0 Karma

AKG1_old1
Builder

Thank you @gcusello . I  have better understading now. 

After reading your reply I think  I do have some other apps which may need to deploy on Indexer.

You mentioned that we can verify these apps in doucments if has indexer components or not. Could you give little more insight how I can verify my all apps. 

agoyal_0-1602667734217.png

Thank you

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @AKG1_old1.,

you can see in apps.splunk.com and check, one by one, in the documentation section of each app, if there's an Indexer component.

Anyway, I'd install on Indexers all the TAs.

Ciao.

Giuseppe

P.S.: if this answer solves your needs, please accept it for the other people of Community and Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...