scripted inputs best practices?

[bfaber]

Are there any best practices regarding where a scripted input should run? Is there a benefit in using an intermediate forwarder to run really intensive scripted inputs?

[dcarmack_splunk]

What is the scripted input doing?

[somesoni2 · Accepted solution]

If the scripted input is really intensive, I would suggest it to run on Heavy forwarders. If ran on SH, it would consume user resources and if ran on Indexers, it's data would only be available on the indexer where it ran and would fail the purpose of distributed configuration.