Deployment Architecture

Run Splunk app on a search peer of an indexer cluster

cafissimo
Communicator

Hello,
please is it possible to distribute a Splunk app, with a scheduled scripted input, to a pool of indexers in a cluster so that only one indexer at a time runs the input? Also, would the scripted input runs on another peer if one peer is down?
From my experience the answer is no...
Thanks.

0 Karma

DavidHourani
Super Champion

Hi @cafissimo,

Configuration across a pool of indexers in a cluster should be homogenous for easier maintenance, better performance and simplicity. It is however "technically" possible to install an app on one of the indexers if you do the install manually on that specific indexer, it would then be possible to do an automated failover (via script) or manual failover if needed.

Depending on the use case some costumers when confronted with such a scenario would rather go for the option where the input is enabled on all indexers which means less of a headache for managing it but more license cost if the volume is too high.

I would say the right answer to your question is "no" you shouldn't have the cluster peers running different apps. But business requirements take precedence sometimes over best practice and therefore you can do it when you see that there is no possibility (which is rarely the case) to have the input running on all ur indexers or even on a set of heavy forwarders.

Cheers,
David

0 Karma

lakshman239
SplunkTrust
SplunkTrust

I wouldn't think so. Also, generally data collection is not recommended on search peers. [ Though you can send an app via cluster master]. Could you not move this script to SH or FWDR layer?

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...