Getting Data In

REST Inputs in cluster architecture

mudragada
Path Finder

Hi,

I have a Splunk Heavy Forwarder, Indexer master and two Indexer slaves, two search heads in the current architecture.
I have few rest inputs within the network (a firewall away) to get the values in.

Now, I need to choose the machine on which the rest_ta app can be installed and define the rest inputs, to an existing index.

By practice/convention, where should the rest_ta app be installed and the inputs defined?

0 Karma
1 Solution

mudragada
Path Finder

Figured this one out. As stated in http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings, REST TA app needs to be installed on all HeavyForwarders - and the deployment-app should be used in HeavyForwarder configuration.

View solution in original post

0 Karma

mudragada
Path Finder

Figured this one out. As stated in http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings, REST TA app needs to be installed on all HeavyForwarders - and the deployment-app should be used in HeavyForwarder configuration.

0 Karma

adonio
Ultra Champion

Hi mudragada,
the Heavy Forwarder is probably your best bet here. the inputs will be defined from the GUI - settings (top right corner) -> Data inputs -> REST

0 Karma

mudragada
Path Finder

I have about 700 rest inputs - which I need to define in a conf file. When I did via the UI, they're going into apps/search/local/inputs.conf. Is there a way we can define the inputs in a different file or folder, other than the ones that are defined already in the search app?

0 Karma

adonio
Ultra Champion

there are many rest inputs packaged ni prebuilt apps, AWS and SalesForce are just an example link here: https://splunkbase.splunk.com/app/1274/ and are free to download at splunkbase. you can package rest inputs in apps of your choice.

0 Karma

mudragada
Path Finder

The REST end points are internal to my network and REST Modular input is what I chose to enable them in Splunk to gather data. AWS app or SalesForce app may not help the situation.

0 Karma

adonio
Ultra Champion

sure, it was just an example, so you can follow the inputs structure.
to your question, yes you can configure in different apps, therefore separate folder
hope it helps

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...