Deployment Architecture

App from single-instance to distributed deployment architecture.

ajain_mi
Explorer

Hi,
I already have splunk app (used splunk JDK for development) which runs fine on single-instance splunk.
I want to make my app compatible for distributed architecture. How can i proceed? Is there a proper documentation for this?

0 Karma
1 Solution

DavidHourani
Super Champion

Hi @ajain_mi,

There is no official document for this as that would really depend on your app and what it does.

Based on whether you've built a DA, TA, SA your app will simply have to go on different components of the distributed environment.

If for example it's an app for collecting data then you'll have to include it on your Heavy Forwaders; if it's a visualization or dashboard app then you need to have it on your SH, etc..

Let me know if that helps or if you need further details.

Cheers,
David

View solution in original post

0 Karma

DavidHourani
Super Champion

Hi @ajain_mi,

There is no official document for this as that would really depend on your app and what it does.

Based on whether you've built a DA, TA, SA your app will simply have to go on different components of the distributed environment.

If for example it's an app for collecting data then you'll have to include it on your Heavy Forwaders; if it's a visualization or dashboard app then you need to have it on your SH, etc..

Let me know if that helps or if you need further details.

Cheers,
David

0 Karma

ajain_mi
Explorer

Thanks, @DavidHourani.
My app does both things it collects data as well as visualize that data.
But I want different things to happen in different places like Forwarder pushing data, Indexer creating indexes and storing the data etc. In short, I want to make my app compatible with distributed deployment.
I used Splunk packaging toolkit (http://dev.splunk.com/view/packaging-toolkit/SP-CAAAE9V#required) to divide my app but that didn't work.

0 Karma

DavidHourani
Super Champion

@ajain_mi,

In that case you just need to split your app into a TA for forwarding and field extraction and an app that contains the dashboards and index definition for indexers and search heads. Then use the documentation to describe what goes where. That's the simplest way to go about it imo.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...