Folks,
In the following Splunk installation [SH -> IDX -> Heavy-Forwarder -> Multiple UFs + Syslog]
Using Enterprise Security. I understand i need to install the main app on the SH, and TA- directories on the Indexers (technically any TA's that have index-time operations), do i also need to deploy the TA- apps on my transit Heavy-Forwarders as well?
I assume no, but thought i'd check to be sure..
Thanks.
Yes, you do actually. Some of the index-time operations will be performed there instead of on the indexer, so they will require that configurations. More info here: http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F
Yes, you do actually. Some of the index-time operations will be performed there instead of on the indexer, so they will require that configurations. More info here: http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F
Thanks gkanapathy. That makes sense. Another reason i should setup the deployment-server to keep it all in sync.