![]() Most add-ons also need to be installed on your Splunk Cloud Platform instance to enable their index- and search-time capabilities. Some add-ons even require specific types of forwarders. Some add-ons require that you install them on a forwarder for data collection. Does the add-on need to be installed on a forwarder in addition to your Splunk Cloud Platform instance?.For more information about IDMs, see See Work with Inputs Data Manager in the Splunk Cloud Platform Admin Manual. Note: If the add-on is tightly integrated with an Enterprise Security search head, you should not use IDM. You still need to use a heavy forwarder if you need to perform parsing or activities other than standard scripted and modular data inputs. However, note that an IDM is not a one-to-one replacement for a heavy forwarder. ![]() In a majority of cases, an IDM will obviate the need for customer-managed infrastructure. The IDM is a hosted solution for Splunk Cloud Platform for scripted and modular inputs. ![]() As a best practice, cloud-based add-ons should be installed on an IDM, and on-premises-based add-ons should be installed on aįorwarder or heavy forwarder. To determine if your deployment has the Classic or Victoria experience, see Determine your Splunk Cloud Platform Experience.įor the Classic experience, any add-on that requires ingestion on the search tier is disallowed in Splunk Cloud Platform, so you need to use IDM or a heavy forwarder to achieve this. If your deployment is on Victoria Experience you can run add-ons that contain scripted and modular inputs directly on the search head. Splunk Cloud Platform deployments on Victoria Experience do not require IDM.
0 Comments
Leave a Reply. |