Hi guys, I've developed an app that will do the following:-
*Have its own namespace, and GUI button for searching... Eventually its own style sheet!
*Have collections/props/transforms.conf with a kvstore defined that will contain my DHCP temporal lookup.
Here are the contents of the files that will power the KVStore:
**collections.conf**
[DHCPCOL]
replicate = true
**transforms.conf**
[DHCPKV]
external_type = kvstore
collection = DHCPCOL
fields_list = _key,dest_ip,dest_mac,dest,netbios
time_field = _time
**props.conf**
[dhcp]
LOOKUP-linkdhcpbyip = DHCPKV dest_ip OUTPUT dest_mac dest netbios
LOOKUP-linkdhcpbydns = DHCPKV dest OUTPUT dest_mac dest_ip netbios
LOOKUP-linkdhcpbynetbios = DHCPKV netbios OUTPUT dest_mac dest_ip dest
As you can see I'm trying for the auto lookups and to be able to replicate the KVStore over 4 indexers, we already have a dhcp index which is being populated that I will use for the KVStore source.
The front-end of the app should be visible in the search head, I'm not sure if I need to split this in to 2 apps or keep it as one?
I have 4 indexers, 1 Search Head, 4 search peers, 1 deployment server. We can't use the deployment server to deploy for this one due to limitations, we only use it for mapping apps to servers, but there is no need for any inputs it will only work with the dhcp index.
Our architect who has left the company told me vaguely how to deploy but said he was not sure himself due to the KVStore replication. We use a version > 6.3.
**Which servers do I need to put this app on to get it to work, all indexers and the search head or ????**
thanks in advance.
↧