All Apps and Add-ons

Data Curator app does not show all dashboards. I need to install it on all indexers too?

sfmandmdev
Path Finder

Does the Data Curator app go on to all indexers too? I just installed it onto the deployer and search head cluster members. Does that not work?

0 Karma

Runals
Motivator

The app is designed to just be installed on a search head. I'm not sure how it would work in a SHC as we don't have one stood up here. There are some summary searches that run and don't know how the SHC would react to apps that have summary searches - does each SH run them? I'd assume so.

At any rate there are a couple reasons the app would/might not show data on certain panels. The first is there are some panels that rely on summary searches to have already run and some of those run just once a day. It is likely that some of the panels will have data today when they didn't yesterday. The second reason is, depending on dashboard/panel, the app assumes the props and transforms configuration files you are sending to your indexers is the same you are sending to your search heads. To that end the rest queries it makes are only looking at the local server. Many TAs are designed like this where index and search time settings are simply bundled together.

There are a number of ways a Splunk environment can be configured. In our case we have several stand alone search heads, moved from stand alone indexers to idx clustering, and are using a deployment server to push changes to our TAs. The TAs we build are per technology/log type and do not differentiate between stuff only applicable to indexers or search heads.

Hope some of that is helpful!

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...