I'm getting ready to install the Splunk app for Palo Alto Networks 3.4 because we are running Splunk 5.0.5, but I have one question. Does the app go on the Search Head or the Indexer?
Both. The app contains transforms for rewriting sourcetypes based on log contents, so it needs to be present on indexers. It also contains a whole bunch of search-time field extractions, so it needs to be on the search head as well.
Both. The app contains transforms for rewriting sourcetypes based on log contents, so it needs to be present on indexers. It also contains a whole bunch of search-time field extractions, so it needs to be on the search head as well.
