(What is the best way to configure and manage receiving ports for clustered indexers?)

Question

Options

• AUse Splunk Web to create the receiving port on each peer node.
• BDefine the receiving port in /etc/deployment-apps/cluster-app/local/inputs.conf and deploy it to
• CRun the splunk enable listen command on each peer node.
• DDefine the receiving port in /etc/manager-apps/_cluster/local/inputs.conf and push it to the peer

• A
  14% (5)
• B
  3% (1)
• C
  8% (3)
• D
  76% (28)

Explanation

According to the Indexer Clustering Administration Guide, the most efficient and Splunk- recommended way to configure and manage receiving ports for all clustered indexers (peer nodes) is through the Cluster Manager (previously known as the Master Node). In a clustered environment, configuration changes that affect all peer nodes-such as receiving port definitions-should be managed centrally. The correct procedure is to define the inputs configuration file (inputs.conf) within the Cluster Manager's manager-apps directory. Specifically, the configuration $SPLUNK_HOME/etc/manager-apps/_cluster/local/inputs.conf and then deployed to all peers using the configuration bundle push mechanism. This centralized approach ensures consistency across all peer nodes, prevents manual configuration drift, and allows Splunk to maintain uniform ingestion behavior across the cluster. Running splunk enable listen on each peer (Option C) or manually configuring inputs via Splunk Web (Option A) introduces inconsistencies and is not recommended in clustered deployments. Using the deployment-apps path (Option B) is meant for deployment servers, not for cluster management. - Indexer Clustering: Configure Peer Nodes via Cluster Manager - Deploy Configuration Bundles from the Cluster Manager - inputs.conf Reference - Receiving Data Configuration - Splunk Enterprise Admin Manual - Managing Clustered Indexers

No community discussion yet for this question.