Getting Data In

An indexer cluster master doesn't need apps, correct?

msaz
Path Finder

I'm new to cluster indexing, and am getting ready to start testing installing apps. Just want to confirm:

  1. Apps are deployed to the indexers using cluster master configuration bundles.
  2. Apps are deployed to the search head and forwarders using the deployment server.
  3. Apps need to be installed on the indexers, search head, and forwarders.
  4. Apps do NOT need to be installed on the cluster master.
0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi @msaz

  1. Yes. You put apps in the etc/master-apps folder on the cluster master then push them to the indexers. They will end up in the etc/slave-apps folders on the indexers.
  2. I find its best to only use the deployment server for pushing to Universal forwarders. You can use it to push apps to search heads, but if you have a search head cluster you should (must) use a "search head deployer". If you don't have a search head cluster then just install apps manually using the UI is easiest for most customers.
  3. Yes. When you get an app from splunkbase read the documentation carefully becuase it will tell you where to put the app.
  4. Yes. Its possible, but rare that you should need to put apps on the cluster master once it is configured.

All the best.

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @msaz

  1. Yes. You put apps in the etc/master-apps folder on the cluster master then push them to the indexers. They will end up in the etc/slave-apps folders on the indexers.
  2. I find its best to only use the deployment server for pushing to Universal forwarders. You can use it to push apps to search heads, but if you have a search head cluster you should (must) use a "search head deployer". If you don't have a search head cluster then just install apps manually using the UI is easiest for most customers.
  3. Yes. When you get an app from splunkbase read the documentation carefully becuase it will tell you where to put the app.
  4. Yes. Its possible, but rare that you should need to put apps on the cluster master once it is configured.

All the best.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...