Best practice is to create an app, call it (your_company_name)_all_indexers or something to that effect, create a default subdirectory and in there populate an app.conf (requirement for Splunk Cloud in particular for versioning) and a props.conf. Splunk best practice is to create apps with the name of the authoring organization and the app's target component in the infrastructure (can be a Splunk tier, a particular source, etc etc). In this case I chose "all_indexers" as the target tier.
In the props.conf put the TRUNCATE=(some #>10000) in the stanzas you create per the Splunk documentation for props (Google Splunk props.conf.spec).
Then, submit it for distribution to your indexers from the cluster master.
... View more
I'd like to mention that the latest documentation also requests to install this TA on the search head cluster - http://docs.splunk.com/Documentation/AddOns/released/VMW/Install
From the install guide:
Upload the Splunk Add-on for VMware to your search heads
Stop your Splunk platform instance.
If using a search head cluster, upload SA-Hydra, SA-VMNetAppUtils, Splunk_TA_esxilogs, Splunk_TA_vcenter, and Splunk_TA_vmware to opt/splunk/etc/shcluster/apps/ on the deployer.
In SHC this also produces numerous errors regarding the inability to initialize the modular input. Removal of the inputs.conf and inputs.conf.spec solves this as well.
... View more