I am a new user to Splunk and have made some choices that have got me in a difficult situation.
I have added a search application to my deployment server, and have added multiple remote search heads/indexers as Clients of a server class that includes the search app.
I have begun trying to use REST API inputs which are unique to each remote indexer.
I am losing my customized REST input because the search app on the deployment server does not have the same inputs file.
I can create multiple REST inputs on the deployment server, but don't want to resort to that as the management of that file will be difficult in the long run.
What alternatives do I have? Can I remove the search app from the deployment server server class? Will that delete my search functionality on my indexers?
Can I remove specific indexers as clients to the server class? Will that remove the search app from that client?
Any help is appreciated.
... View more