Deployment Architecture

Run Splunk app on a search peer of an indexer cluster

cafissimo
Communicator

Hello,
please is it possible to distribute a Splunk app, with a scheduled scripted input, to a pool of indexers in a cluster so that only one indexer at a time runs the input? Also, would the scripted input runs on another peer if one peer is down?
From my experience the answer is no...
Thanks.

0 Karma

DavidHourani
Super Champion

Hi @cafissimo,

Configuration across a pool of indexers in a cluster should be homogenous for easier maintenance, better performance and simplicity. It is however "technically" possible to install an app on one of the indexers if you do the install manually on that specific indexer, it would then be possible to do an automated failover (via script) or manual failover if needed.

Depending on the use case some costumers when confronted with such a scenario would rather go for the option where the input is enabled on all indexers which means less of a headache for managing it but more license cost if the volume is too high.

I would say the right answer to your question is "no" you shouldn't have the cluster peers running different apps. But business requirements take precedence sometimes over best practice and therefore you can do it when you see that there is no possibility (which is rarely the case) to have the input running on all ur indexers or even on a set of heavy forwarders.

Cheers,
David

0 Karma

lakshman239
Influencer

I wouldn't think so. Also, generally data collection is not recommended on search peers. [ Though you can send an app via cluster master]. Could you not move this script to SH or FWDR layer?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...