Splunk Dev

Cannot correctly partition the app for the workloads with slim partition?

nextpart
Explorer

My colleagues and I have been biting our tongues trying to get the partitioning right with the slim-packaging-toolkit.

We manage to package the technical add-on from the source code into the tar.gz file and then execute the command to get the packages for the specified workloads, but they don't differ. We have been trying several things regarding the "tasks" and "inputGroups" specification in the app.manifest file, but we can't manage to split the app so that all the python stuff is only in the forwarder partition and none of it is in the searchhead partition to install it via self-service in splunkcloud.


Any kind of help and all materials and resources, apart from the standard documentation, which unfortunately doesn't help much, is very welcome and appreciated.

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...