Deployment Architecture

Run Splunk app on a search peer of an indexer cluster

cafissimo
Communicator

Hello,
please is it possible to distribute a Splunk app, with a scheduled scripted input, to a pool of indexers in a cluster so that only one indexer at a time runs the input? Also, would the scripted input runs on another peer if one peer is down?
From my experience the answer is no...
Thanks.

0 Karma

DavidHourani
Super Champion

Hi @cafissimo,

Configuration across a pool of indexers in a cluster should be homogenous for easier maintenance, better performance and simplicity. It is however "technically" possible to install an app on one of the indexers if you do the install manually on that specific indexer, it would then be possible to do an automated failover (via script) or manual failover if needed.

Depending on the use case some costumers when confronted with such a scenario would rather go for the option where the input is enabled on all indexers which means less of a headache for managing it but more license cost if the volume is too high.

I would say the right answer to your question is "no" you shouldn't have the cluster peers running different apps. But business requirements take precedence sometimes over best practice and therefore you can do it when you see that there is no possibility (which is rarely the case) to have the input running on all ur indexers or even on a set of heavy forwarders.

Cheers,
David

0 Karma

lakshman239
Influencer

I wouldn't think so. Also, generally data collection is not recommended on search peers. [ Though you can send an app via cluster master]. Could you not move this script to SH or FWDR layer?

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...