Solved: Where do I deploy scripted inputs in a Splunk 6.2.... - Page 2

dturner83 · ‎08-05-2015

We've got a 3 indexer - 3 search head setup on 6.2.4 using indexer clustering, search head clustering, and a deployer to configure search heads.

I've got a scripted input that reaches out for data via 3rd party api and then returns that data to be indexed.

My question is where should this go? If I deploy it via deployer on the search heads, each search head indexes the data locally in it's main index. If I put it on the indexer it doesn't appear to run and doesn't put any data into an index.

bmacias84 · ‎08-05-2015

I would never recommend putting script which collect data on any cluster member search or indexer. Instead I would recommend setting up a Universal or Heavy Forwarder for all third-party API or inputs from a remote machine. This will prevent accidentally index data multiple times. At this point you could use the Deployment Server.

View solution in original post

Where do I deploy scripted inputs in a Splunk 6.2.4 environment with both indexer and search head clustering?

Announcing Scheduled Export GA for Dashboard Studio

Extending Observability Content to Splunk Cloud

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!