Deployment Architecture

splunk distributed environment issues

elkhafif
Explorer

I have some questions that i hope someone can help me clarifying them :
1) In an indexer cluster, can i install apps and add-ons on each indexer separatly without pushing all using the cluster master?

2)If i will use cluster master, should i untar the apps and add-ons that i put in /master-apps or no need for the unpacking step ?

3)how to use sendtoindexer app if i have an indexer cluster ?, I mean , what should be written in the text file exactly ?
thanks in advance

0 Karma

woodcock
Esteemed Legend

1: Yes, but then use this as your ONLY method of deploying configuration changes.
2: You should unpack them, but not by manually with tar. There is potentially MUCH more that happens when some complicated apps are installed (like SecKit* and SideView Utils) and you will BREAK the app if you just untar. Instead ALWAYS use $SPLUNK_HOME/bin/splunk install
3: That app should just have an outputs.conf file.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

1) Yes, but why do that? Using the CM means not having to install apps on each indexer separately. It also avoids the potential conflict if the same app is both locally-installed and CM-installed.

2) Yes, untar the app in master-apps.

3) The sendtoindexer app is installed on forwarders. It should be placed your deployment servers's deployment-apps directory and deployed to the appropriate forwarders. The outputs.conf file will contain the addresses for your indexers. Alternatively, if you're using Indexer Discovery the file will contain the address of your cluster master.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

elkhafif
Explorer

could u please give me an example of the syntax written in the text if for example the ips of the indexers are 192.168.1.3/4 and the CM is .5 ?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

See https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/Outputsconf

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!