How to schedule indexing and search jobs within an indexer and search head cluster?

[nychawk]

Hello;

I have a job that connects to an external (non-Splunk) source, pulls data, then indexes it. My setup worked fine, but now I have an Indexer Cluster, and am not sure how to set this up. What's confusing me is if there is a way to deploy an app on either a search head cluster, or indexer cluster, where only one device performs an action, otherwise I would end up with my data multiplied by my number of search heads or indexers (yes, I can run from either one).

Any suggestions greatly appreciated.

[renjith_nair]

You can configure it by a scheduled search on the search head cluster if possible. If it's a script then you configure it as an alert action and pack the searches and scripts to an app and deploy. This will make sure that the search executes only on one of the members and you have high availability.

Other possibility is that configure your app locally on any of the search head member (/etc/apps/)- you do not have redundancy in this case ie . if that search head is down, then your application will not work.