Getting Data In

How to configure inputs without duplicate data with an add on installed on HF/indexer, and SH?

lmjoin
Explorer

Hello Team,

I have one question . we have to installed addon on heavy forwarded or indexer and then need to install on search head. we are configuring addon on HV/I and SH . Could you please suggest both are configured for data inputs and not make duplicate data.

Thnk

0 Karma

vinkumar_splunk
Splunk Employee
Splunk Employee

I assume you have the add-on installed on HF / Indexer and SH and you want to know where to configure the inputs and ensure not to make duplicate data by configuring on multiple instances.

If the above is the case, then below is the answer to it. If not, please provide more information on your requirement.

Add-ons that contain inputs belong on forwarders, and in some select cases also on search heads. Inputs that contain dynamic lookups need to be installed on search heads because they feed results back into the input directly from the search. Consult the documentation of the add-on for special instructions.

https://docs.splunk.com/Documentation/AddOns/released/Overview/Wheretoinstall

0 Karma

woodcock
Esteemed Legend

Please have somebody else review what you are trying to say and expand your question for more clarity. I have no idea what you mean here.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...