I have a Splunk Heavy Forwarder, Indexer master and two Indexer slaves, two search heads in the current architecture.
I have few rest inputs within the network (a firewall away) to get the values in.
Now, I need to choose the machine on which the rest_ta app can be installed and define the rest inputs, to an existing index.
By practice/convention, where should the rest_ta app be installed and the inputs defined?
the Heavy Forwarder is probably your best bet here. the inputs will be defined from the GUI - settings (top right corner) -> Data inputs -> REST
I have about 700 rest inputs - which I need to define in a conf file. When I did via the UI, they're going into apps/search/local/inputs.conf. Is there a way we can define the inputs in a different file or folder, other than the ones that are defined already in the search app?
there are many rest inputs packaged ni prebuilt apps, AWS and SalesForce are just an example link here: https://splunkbase.splunk.com/app/1274/ and are free to download at splunkbase. you can package rest inputs in apps of your choice.
The REST end points are internal to my network and REST Modular input is what I chose to enable them in Splunk to gather data. AWS app or SalesForce app may not help the situation.
sure, it was just an example, so you can follow the inputs structure.
to your question, yes you can configure in different apps, therefore separate folder
hope it helps
Figured this one out. As stated in http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings, REST TA app needs to be installed on all HeavyForwarders - and the deployment-app should be used in HeavyForwarder configuration.