Where to implement Ingest Actions?

[dokaas_2]

In a recent "Splunk Enterprise 9.0 Data Administration" class, the documentation says that Ingest Actions should be implemented on a Deployment Server.  Am I correct that this only refers to Ingest Actions defined for a heavy forwarder and that if the Ingest Action is to be deployed on an indexer it should be defined on the cluster manager?

[gcusello]

Hi @dokaas_2,

the Deployment Server has the role to manage configurations (so also the ingestion configuratios) for all kind of Forwarders (Universal and Heavy).

Instaed Indexers, when Clustered, are managed by the Master Node and Search Heads are managed by the Deployer.

Only for semantic, I'd like to understand what you mean with "Ingest Actions", because if you mean configurations to igest data using the inputs.conf, it's correct that they are amanged by the DS, but In general I'd say that Ingestion Actions are the role of Forwarders (HF or UF), that are really managed by the DS.

Ciao.

Giuseppe

[dokaas_2]

To clarify.  Splunk +9 provides 'ingest actions' to filter, mask and route data.  This can be done on a heavy forwarder or indexer.  Heavy forwarders would receive their configuration from a deployment server, but clustered indexers receive their configuration from the cluster manager (I guess stand-alone indexers could get their configurations from a deployment server too). 

It was that in the class documentation, they only mentioned that 'ingest actions' were deployed through the deployment server and not that they would be deployed by the cluster manager if you had clustered indexers.

[gcusello]

Hi @dokaas_2 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[richgalloway · Accepted solution]

Yes, you are correct.  Deployment Servers apply to forwarders; use the CM for clustered indexers