Deployment Architecture

How to schedule indexing and search jobs within an indexer and search head cluster?

nychawk
Communicator

Hello;

I have a job that connects to an external (non-Splunk) source, pulls data, then indexes it. My setup worked fine, but now I have an Indexer Cluster, and am not sure how to set this up. What's confusing me is if there is a way to deploy an app on either a search head cluster, or indexer cluster, where only one device performs an action, otherwise I would end up with my data multiplied by my number of search heads or indexers (yes, I can run from either one).

Any suggestions greatly appreciated.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

You can configure it by a scheduled search on the search head cluster if possible. If it's a script then you configure it as an alert action and pack the searches and scripts to an app and deploy. This will make sure that the search executes only on one of the members and you have high availability.

Other possibility is that configure your app locally on any of the search head member (/etc/apps/)- you do not have redundancy in this case ie . if that search head is down, then your application will not work.

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...