Getting Data In

An indexer cluster master doesn't need apps, correct?

msaz
Path Finder

I'm new to cluster indexing, and am getting ready to start testing installing apps. Just want to confirm:

  1. Apps are deployed to the indexers using cluster master configuration bundles.
  2. Apps are deployed to the search head and forwarders using the deployment server.
  3. Apps need to be installed on the indexers, search head, and forwarders.
  4. Apps do NOT need to be installed on the cluster master.
0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi @msaz

  1. Yes. You put apps in the etc/master-apps folder on the cluster master then push them to the indexers. They will end up in the etc/slave-apps folders on the indexers.
  2. I find its best to only use the deployment server for pushing to Universal forwarders. You can use it to push apps to search heads, but if you have a search head cluster you should (must) use a "search head deployer". If you don't have a search head cluster then just install apps manually using the UI is easiest for most customers.
  3. Yes. When you get an app from splunkbase read the documentation carefully becuase it will tell you where to put the app.
  4. Yes. Its possible, but rare that you should need to put apps on the cluster master once it is configured.

All the best.

View solution in original post

chrisyounger
SplunkTrust
SplunkTrust

Hi @msaz

  1. Yes. You put apps in the etc/master-apps folder on the cluster master then push them to the indexers. They will end up in the etc/slave-apps folders on the indexers.
  2. I find its best to only use the deployment server for pushing to Universal forwarders. You can use it to push apps to search heads, but if you have a search head cluster you should (must) use a "search head deployer". If you don't have a search head cluster then just install apps manually using the UI is easiest for most customers.
  3. Yes. When you get an app from splunkbase read the documentation carefully becuase it will tell you where to put the app.
  4. Yes. Its possible, but rare that you should need to put apps on the cluster master once it is configured.

All the best.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...