All Apps and Add-ons

Does app Splunk for Palo Alto Networks go on search head or indexer?

OldManEd
Builder

I'm getting ready to install the Splunk app for Palo Alto Networks 3.4 because we are running Splunk 5.0.5, but I have one question. Does the app go on the Search Head or the Indexer?

1 Solution

Ayn
Legend

Both. The app contains transforms for rewriting sourcetypes based on log contents, so it needs to be present on indexers. It also contains a whole bunch of search-time field extractions, so it needs to be on the search head as well.

View solution in original post

Ayn
Legend

Both. The app contains transforms for rewriting sourcetypes based on log contents, so it needs to be present on indexers. It also contains a whole bunch of search-time field extractions, so it needs to be on the search head as well.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...