Getting Data In

An indexer cluster master doesn't need apps, correct?

msaz
Path Finder

I'm new to cluster indexing, and am getting ready to start testing installing apps. Just want to confirm:

  1. Apps are deployed to the indexers using cluster master configuration bundles.
  2. Apps are deployed to the search head and forwarders using the deployment server.
  3. Apps need to be installed on the indexers, search head, and forwarders.
  4. Apps do NOT need to be installed on the cluster master.
0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi @msaz

  1. Yes. You put apps in the etc/master-apps folder on the cluster master then push them to the indexers. They will end up in the etc/slave-apps folders on the indexers.
  2. I find its best to only use the deployment server for pushing to Universal forwarders. You can use it to push apps to search heads, but if you have a search head cluster you should (must) use a "search head deployer". If you don't have a search head cluster then just install apps manually using the UI is easiest for most customers.
  3. Yes. When you get an app from splunkbase read the documentation carefully becuase it will tell you where to put the app.
  4. Yes. Its possible, but rare that you should need to put apps on the cluster master once it is configured.

All the best.

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @msaz

  1. Yes. You put apps in the etc/master-apps folder on the cluster master then push them to the indexers. They will end up in the etc/slave-apps folders on the indexers.
  2. I find its best to only use the deployment server for pushing to Universal forwarders. You can use it to push apps to search heads, but if you have a search head cluster you should (must) use a "search head deployer". If you don't have a search head cluster then just install apps manually using the UI is easiest for most customers.
  3. Yes. When you get an app from splunkbase read the documentation carefully becuase it will tell you where to put the app.
  4. Yes. Its possible, but rare that you should need to put apps on the cluster master once it is configured.

All the best.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...