All Apps and Add-ons

Do we need to install this add-on on indexers?

shubham87
Explorer

Please let me know if we need to install this add-on on our indexers? I have already installed same on Heavy forwarders and search head

0 Karma

jbrocks
Communicator

Reading the description of the Addon it is said that it will map data to the CIM, which means it has at least a props.conf - so I would install the Addon on an Indexer OR Heavy Forwarder and - if it does not seem to work - I would also try to install the Addon on the Search Head. Did you get any data and new fields as you tried installing at a Search Head and a heavy Forwarder?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...