Getting Data In
Highlighted

REST Inputs in cluster architecture

Path Finder

Hi,

I have a Splunk Heavy Forwarder, Indexer master and two Indexer slaves, two search heads in the current architecture.
I have few rest inputs within the network (a firewall away) to get the values in.

Now, I need to choose the machine on which the rest_ta app can be installed and define the rest inputs, to an existing index.

By practice/convention, where should the rest_ta app be installed and the inputs defined?

0 Karma
Highlighted

Re: REST Inputs in cluster architecture

SplunkTrust
SplunkTrust

Hi mudragada,
the Heavy Forwarder is probably your best bet here. the inputs will be defined from the GUI - settings (top right corner) -> Data inputs -> REST

0 Karma
Highlighted

Re: REST Inputs in cluster architecture

Path Finder

I have about 700 rest inputs - which I need to define in a conf file. When I did via the UI, they're going into apps/search/local/inputs.conf. Is there a way we can define the inputs in a different file or folder, other than the ones that are defined already in the search app?

0 Karma
Highlighted

Re: REST Inputs in cluster architecture

SplunkTrust
SplunkTrust

there are many rest inputs packaged ni prebuilt apps, AWS and SalesForce are just an example link here: https://splunkbase.splunk.com/app/1274/ and are free to download at splunkbase. you can package rest inputs in apps of your choice.

0 Karma
Highlighted

Re: REST Inputs in cluster architecture

Path Finder

The REST end points are internal to my network and REST Modular input is what I chose to enable them in Splunk to gather data. AWS app or SalesForce app may not help the situation.

0 Karma
Highlighted

Re: REST Inputs in cluster architecture

SplunkTrust
SplunkTrust

sure, it was just an example, so you can follow the inputs structure.
to your question, yes you can configure in different apps, therefore separate folder
hope it helps

0 Karma
Highlighted

Re: REST Inputs in cluster architecture

Path Finder

Figured this one out. As stated in http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings, REST TA app needs to be installed on all HeavyForwarders - and the deployment-app should be used in HeavyForwarder configuration.

View solution in original post

0 Karma