Do I really need to care if the props.conf or inputs.conf or apps get deployed to universal forwarders or search heads or indexers? If there are inputs.conf stanzas that are looking for file in a place that doesn't exist on a server will that cause performance issues?
I don't think you will see full documentation, but can say it is a bad practice to deploy all apps on all Splunk components
In my opinion, without best practices, control of configs and correct naming conventions it is very hard to administer in large enterprise systems.
I don't think you will see full documentation, but can say it is a bad practice to deploy all apps on all Splunk components
In my opinion, without best practices, control of configs and correct naming conventions it is very hard to administer in large enterprise systems.
Why would you do that? ; - )
It is not that I want to do this but the system that I am currently supporting was set up this way. I would like to change it but would like some documentation saying that this is not the best practice or that it may cause performance issues. I need to justify the time to change this.