- Splunk Answers
- :
- Using Splunk
- :
- Splunk Dev
- :
- Where should I create custom app. on search head o...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Where should I create custom app. on search head or app server (indexer) ?
I am not using deployment server in our environment yet. I have non-clustered search head and three indexers. If I want to create custom app where should I create it. on search head server or app server (indexer)?
I have same setup in A side (primary) and B side (standby). Both active - active.
A side - one search head and three app servers (indexers).
B side - one search head and three app servers (indexers).
I know this will consume double license but that's the requirement.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Recommendation is to restrict apps/dashboards to search heads.
And leave indexers to only receive data from forwarders and store indexes.
If you can read your index data from search heads, dashboards/apps can be created only at the search layer.
Users should be restricted to only search heads where your dashboards reside. This way, the indexed data would be safe/untouched at the indexer layer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the link which is very helpful. However, it does not provide answer I was looking for,
If I create new app or dashboard, whether I should create it on search head or indexer server itself?
If I create app or dashboard on search head, does it propagate that to the indexers automatic or I have to copy files manually from search head to indexer.
I am just thinking about syncing apps, dashboards, custom fields etc. etc. between search head and indexers.
I believe by default it does not get sync in between.
I created custom fields on search head for one type of data and created custom fields on indexer for second type of data.
When I looked into both search head and indexers, custom fields were missing on server other than where it was created.
So, I had to modify props.conf and transforms.conf manually so that it appears on other servers as well.
Is this the method I need to adopt or it can be achieved using some configuration level on search head and/or indexers?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What is this new app used for? Usually apps sit on Search head layer
Refer this link for examples/process - http://dev.splunk.com/view/quickstart/SP-CAAAFDC
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is your issue resolved? kindly accept and/or upvote my response if it helped
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
.conf24 | Personalize your .conf experience with Learning Paths!
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
