If i have to Install Cisco Network APP in a distributed environment , i have a data collection layer having heavy forwarders where i am installing all the apps and then sending filtered data to indexers. Where should i install App and also its Add-on?
install the add-on on your heavy forwarders and search heads
install the app itself on the search head/s
https://splunkbase.splunk.com/app/1352/#/details