What Splunk server do you point the eStreamer config to? The Search Head the app is installed on or the indexers?

[andrew_bostic1]

The instructions below reference "splunk server".. which server are they referencing? The Search Head or indexers??

//Begin by creating the client certificate for the Splunk server from the Defense Center web interface. You can accomplish by logging into the Defense Center with an Admin account and selecting System > Local > Registration, then clicking the Create Client button. Sourcefire recommends that you use the IP address of the Splunk server rather than its hostname. The password is optional. Download the pkcs12 certificate and copy it onto the Splunk server.

[Jeremiah · Accepted solution]

Andrew,

You'd want to run it on a search head or on a heavy forwarder pointed at your indexers. Running it directly on an indexer would put all of the data on that single indexer. In a distributed environment, you want to spread the data evenly across your indexing tier. We like to run the data collection portion of these kinds of apps on forwarders, because it reduces the load on the search head and allows us to make changes to the configuration without impacting search activity.

[andrew_bostic1]

So if I install on the Search Head, will the data be stored there or will it be distributed to my indexers (if i have the appropriate outputs.conf configured of course)???

At this point I do not have a HF to take this load.. but I could potentially get one. So the same question for this possibility, will the data be distributed to my indexers (if i have the appropriate outputs.conf configured of course)???

[Jeremiah]

Yes, if you have your search head set to forward to your indexers (which is a best practice), then the data will be stored on the indexers. Same goes for your forwarder.