https://community.splunk.com/t5/All-Apps-and-Add-ons/Install-TA-on-SH-only-or-both-SH-and-HF/m-p/389118#M47495 <P>That depends on whether the TA contains only search time configuration (e.g. field extractions), or also index time configuration (e.g. timestamping, linebreaking...).</P> <P>Since this TA includes linebreaking and timestamping config, you need to put it on the HF as well.</P> Wed, 03 Apr 2019 08:14:59 GMT FrankVl 2019-04-03T08:14:59Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Install-TA-on-SH-only-or-both-SH-and-HF/m-p/389117#M47494 <P>Hi. Would I install the TA for fail2ban on just the search head or on the heavy forwarder also?</P> Wed, 03 Apr 2019 07:52:37 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Install-TA-on-SH-only-or-both-SH-and-HF/m-p/389117#M47494 apcsplunkadmin 2019-04-03T07:52:37Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Install-TA-on-SH-only-or-both-SH-and-HF/m-p/389118#M47495 <P>That depends on whether the TA contains only search time configuration (e.g. field extractions), or also index time configuration (e.g. timestamping, linebreaking...).</P> <P>Since this TA includes linebreaking and timestamping config, you need to put it on the HF as well.</P> Wed, 03 Apr 2019 08:14:59 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Install-TA-on-SH-only-or-both-SH-and-HF/m-p/389118#M47495 FrankVl 2019-04-03T08:14:59Z