Deployment Architecture

How to schedule indexing and search jobs within an indexer and search head cluster?



I have a job that connects to an external (non-Splunk) source, pulls data, then indexes it. My setup worked fine, but now I have an Indexer Cluster, and am not sure how to set this up. What's confusing me is if there is a way to deploy an app on either a search head cluster, or indexer cluster, where only one device performs an action, otherwise I would end up with my data multiplied by my number of search heads or indexers (yes, I can run from either one).

Any suggestions greatly appreciated.

0 Karma


You can configure it by a scheduled search on the search head cluster if possible. If it's a script then you configure it as an alert action and pack the searches and scripts to an app and deploy. This will make sure that the search executes only on one of the members and you have high availability.

Other possibility is that configure your app locally on any of the search head member (/etc/apps/)- you do not have redundancy in this case ie . if that search head is down, then your application will not work.

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...