https://community.splunk.com/t5/All-Apps-and-Add-ons/Protocol-Data-Inputs-Where-to-install-the-add-on/m-p/358145#M43371 <P>Yes that is possible.<BR /> UF -&gt; <A href="http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Forwarding/Forwarddatatothird-partysystemsd#TCP_data">forward raw TCP</A> -&gt; PDI App's TCP Port running on HF</P> Thu, 28 Dec 2017 19:57:12 GMT Damien_Dallimor 2017-12-28T19:57:12Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Protocol-Data-Inputs-Where-to-install-the-add-on/m-p/358142#M43368 <P>Hi,</P> <P>I would like to use the add-on Protocol Data Inputs but I am unsure where should it be installed (meaning if it must be on every indexer part of a cluster --&gt; master server ?) Or install on a dedicated server like Heavy Forwarder.</P> <P>Thanks for your help.</P> Thu, 28 Dec 2017 08:53:43 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Protocol-Data-Inputs-Where-to-install-the-add-on/m-p/358142#M43368 SirHill17 2017-12-28T08:53:43Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Protocol-Data-Inputs-Where-to-install-the-add-on/m-p/358143#M43369 <P>Install on a Forwarder.</P> Thu, 28 Dec 2017 09:05:47 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Protocol-Data-Inputs-Where-to-install-the-add-on/m-p/358143#M43369 Damien_Dallimor 2017-12-28T09:05:47Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Protocol-Data-Inputs-Where-to-install-the-add-on/m-p/358144#M43370 <P>Thanks for your quick answer.<BR /> I have another question following your answer. My aim is to have a centralized component masking data for all my servers (+2000) so if I can avoid deploying the add-on on every single host is better and also not impacting the servers where the forwarders run. Do you think it's possible to install the add-on on a Heavy Forwarder and having the UF sending the data to this HF which will handle the data ?</P> Thu, 28 Dec 2017 09:18:09 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Protocol-Data-Inputs-Where-to-install-the-add-on/m-p/358144#M43370 SirHill17 2017-12-28T09:18:09Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Protocol-Data-Inputs-Where-to-install-the-add-on/m-p/358145#M43371 <P>Yes that is possible.<BR /> UF -&gt; <A href="http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Forwarding/Forwarddatatothird-partysystemsd#TCP_data">forward raw TCP</A> -&gt; PDI App's TCP Port running on HF</P> Thu, 28 Dec 2017 19:57:12 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Protocol-Data-Inputs-Where-to-install-the-add-on/m-p/358145#M43371 Damien_Dallimor 2017-12-28T19:57:12Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Protocol-Data-Inputs-Where-to-install-the-add-on/m-p/358146#M43372 <P>Thanks for your help.</P> Fri, 29 Dec 2017 08:38:35 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Protocol-Data-Inputs-Where-to-install-the-add-on/m-p/358146#M43372 SirHill17 2017-12-29T08:38:35Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Protocol-Data-Inputs-Where-to-install-the-add-on/m-p/358147#M43373 <P>My pleasure , shout out if you need any more help with custom handlers etc.. (I wrote the app).</P> Fri, 29 Dec 2017 23:41:29 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Protocol-Data-Inputs-Where-to-install-the-add-on/m-p/358147#M43373 Damien_Dallimor 2017-12-29T23:41:29Z