splunk distributed environment issues

[elkhafif]

I have some questions that i hope someone can help me clarifying them :
1) In an indexer cluster, can i install apps and add-ons on each indexer separatly without pushing all using the cluster master?

2)If i will use cluster master, should i untar the apps and add-ons that i put in /master-apps or no need for the unpacking step ?

3)how to use sendtoindexer app if i have an indexer cluster ?, I mean , what should be written in the text file exactly ?
thanks in advance

[woodcock]

1: Yes, but then use this as your ONLY method of deploying configuration changes.
2: You should unpack them, but not by manually with tar. There is potentially MUCH more that happens when some complicated apps are installed (like SecKit* and SideView Utils) and you will BREAK the app if you just untar. Instead ALWAYS use $SPLUNK_HOME/bin/splunk install
3: That app should just have an outputs.conf file.

[richgalloway]

1) Yes, but why do that? Using the CM means not having to install apps on each indexer separately. It also avoids the potential conflict if the same app is both locally-installed and CM-installed.

2) Yes, untar the app in master-apps.

3) The sendtoindexer app is installed on forwarders. It should be placed your deployment servers's deployment-apps directory and deployed to the appropriate forwarders. The outputs.conf file will contain the addresses for your indexers. Alternatively, if you're using Indexer Discovery the file will contain the address of your cluster master.

[elkhafif]

could u please give me an example of the syntax written in the text if for example the ips of the indexers are 192.168.1.3/4 and the CM is .5 ?

[richgalloway]

See https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/Outputsconf