My questions is about Splunk Entreprise, Clustering and Script with SDK Python.
I want add some datas in some indexes which are on a cluster.
Architecture: 1 forwarder + 5 nodes + 3 searcheads + 1 master
I don't know where to run some scripts like submit.py
It's necessary my data be in cluster.
How do i configure my .splunkrc and where execute scripts ?
Thanks for your help.
MyConfig: >Splunk 7.1 : 1 forwarder -> 5 nodes <-> 3 searcheads <-> 1 master
If you want to run custom scripts it's a best practice to setup a heavy forwarder which can be a central place to do so. Just configure this to send the data to the indexers like you would with any other universal forwarder.