All Apps and Add-ons

Install this where?

ajhstn
Explorer

Should this add-on be installed on my linux forwarder machines in addition to the main Splunk server?

0 Karma
1 Solution

493669
Super Champion

Have a look at this detailed post about Installation and Configuration
https://github.com/doksu/splunk_auditd/wiki/Installation-and-Configuration

View solution in original post

0 Karma

doksu
Contributor

Thanks very much for the question @ajhstn. I've updated the documentation to explicitly indicate that neither app should be installed on universal forwarders. Installing the TA on universal forwarders won't cause a problem, but there's no benefit in doing so.

0 Karma

ajhstn
Explorer

Thank you @doksu 🙂

0 Karma

493669
Super Champion

Have a look at this detailed post about Installation and Configuration
https://github.com/doksu/splunk_auditd/wiki/Installation-and-Configuration

0 Karma
Get Updates on the Splunk Community!

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...