Deployment Architecture

Run Splunk app on a search peer of an indexer cluster

cafissimo
Communicator

Hello,
please is it possible to distribute a Splunk app, with a scheduled scripted input, to a pool of indexers in a cluster so that only one indexer at a time runs the input? Also, would the scripted input runs on another peer if one peer is down?
From my experience the answer is no...
Thanks.

0 Karma

DavidHourani
Super Champion

Hi @cafissimo,

Configuration across a pool of indexers in a cluster should be homogenous for easier maintenance, better performance and simplicity. It is however "technically" possible to install an app on one of the indexers if you do the install manually on that specific indexer, it would then be possible to do an automated failover (via script) or manual failover if needed.

Depending on the use case some costumers when confronted with such a scenario would rather go for the option where the input is enabled on all indexers which means less of a headache for managing it but more license cost if the volume is too high.

I would say the right answer to your question is "no" you shouldn't have the cluster peers running different apps. But business requirements take precedence sometimes over best practice and therefore you can do it when you see that there is no possibility (which is rarely the case) to have the input running on all ur indexers or even on a set of heavy forwarders.

Cheers,
David

0 Karma

lakshman239
Influencer

I wouldn't think so. Also, generally data collection is not recommended on search peers. [ Though you can send an app via cluster master]. Could you not move this script to SH or FWDR layer?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...