Small Enterprise Cluster - General Questions

[rewritex]

I am currently setting up a Small Enterprise Cluster ...
(1) SH (Not clustered) ( Also the License Server)
(2) indexers-(clustered)
(1) Master (Also the DMC)
(x) U-Forwarders

Apps/Field extractions - Configuration Bundle
In my research, I modify the apps as needed and drop them into the master-apps configuration bundle and push to cluster.
Q1: Do I put a mirror copy of the app onto the SH?
** Currently I am putting the APP into the SH and removing the indexes.conf so as to not override the one in the Config.Bundle.

Q2: For field extractions, do I put a duplicate copy of the APP onto the SH or do I do a combination of Config.Bundle and modified copy?

Searching from the SH
Currently when doing a search from the SH, it pulls the same data from both indexers.
Q: I only want my SH to search on the core data. Is this the correct thinking? Maybe I should modify my SF to = 1?

Multiple Admins - where will they do their work?
I have multiple admins with their own apps (ie different departments)
Q: Will each admin need to work from the master or continue to Add/Modify/Edit from the SH which will make local changes?

Sean

[masonmorales · Accepted solution]

Apps/Field extractions - Configuration Bundle
In my research, I modify the apps as needed and drop them into the master-apps configuration bundle and push to cluster.
Q1: Do I put a mirror copy of the app onto the SH?
** Currently I am putting the APP into the SH and removing the indexes.conf so as to not override the one in the Config.Bundle.
Yes, you have to put a duplicate copy of app/TA onto the SH. If the app only contains dashboards, you do not need to push it to the indexer cluster.

Q2: For field extractions, do I put a duplicate copy of the APP onto the SH or do I do a combination of Config.Bundle and modified copy?
Field extractions only live on the SH. The only things you have to push from the master to the indexer cluster are any parsing settings within props and transforms, as well as the indexes.conf.

Searching from the SH
Currently when doing a search from the SH, it pulls the same data from both indexers.
Q: I only want my SH to search on the core data. Is this the correct thinking? Maybe I should modify my SF to = 1?
Replicated data will not cause duplicates to be displayed in the search results. This sounds like a forwarder problem. How have you configured outputs.conf?

Multiple Admins - where will they do their work?
I have multiple admins with their own apps (ie different departments)
Q: Will each admin need to work from the master or continue to Add/Modify/Edit from the SH which will make local changes?
If they are doing field extractions and dashboards, they can just make those changes at the SH. Again, the only thing you need to push to the indexes is configurations related to parsing.

[rewritex]

Thanks for the fast response ...

The duplicates issue seems to be fixed. I think it was my inputs.conf on the forwarder

After updating my _TCP_ROUTING = entry to point to the correct groups within my outputs.conf, things are working.