Deployment Architecture

Run Splunk app on a search peer of an indexer cluster

cafissimo
Communicator

Hello,
please is it possible to distribute a Splunk app, with a scheduled scripted input, to a pool of indexers in a cluster so that only one indexer at a time runs the input? Also, would the scripted input runs on another peer if one peer is down?
From my experience the answer is no...
Thanks.

0 Karma

DavidHourani
Super Champion

Hi @cafissimo,

Configuration across a pool of indexers in a cluster should be homogenous for easier maintenance, better performance and simplicity. It is however "technically" possible to install an app on one of the indexers if you do the install manually on that specific indexer, it would then be possible to do an automated failover (via script) or manual failover if needed.

Depending on the use case some costumers when confronted with such a scenario would rather go for the option where the input is enabled on all indexers which means less of a headache for managing it but more license cost if the volume is too high.

I would say the right answer to your question is "no" you shouldn't have the cluster peers running different apps. But business requirements take precedence sometimes over best practice and therefore you can do it when you see that there is no possibility (which is rarely the case) to have the input running on all ur indexers or even on a set of heavy forwarders.

Cheers,
David

0 Karma

lakshman239
Influencer

I wouldn't think so. Also, generally data collection is not recommended on search peers. [ Though you can send an app via cluster master]. Could you not move this script to SH or FWDR layer?

0 Karma
Get Updates on the Splunk Community!

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...