Support for Search Head Cluster

[VatsalJagani]

Support for Search Head Cluster

• Because currently, it's running the custom command with savedsearch, which executes on only one search head.

• The limits.conf will be replicated but not the geo-IP-location file.

• We have two options:

1. Change it to Mod inputs and enable it to run on all SHs.

   • Reference - inputs.conf --- run_only_one
   • In app.manifest the “tasks" block is used to specify inputs that run on the SH tier (for the Classic architecture only)

2. Find the option to replicate the geo-ip-location file also to all the SHs.

   • Create a custom rest-endpoint to upload and download the file and store it.
   • Reference - https://splunkbase.splunk.com/app/6310/

[VatsalJagani]

Currently fixed the cloud support issue and provided support for SHC.

• Enabled scripted input with run_only_one=false parameter.
• Scheduled search and custom command are still present in disabled mode.

[VatsalJagani]

App version 2.0.0 has been released with proper support of the Search Head Cluster across all kind of environments. https://splunkbase.splunk.com/app/5482