https://community.splunk.com/t5/Getting-Data-In/onboarding-of-cloudflare-with-splunk/m-p/691719#M115037 <P>To which add-on do you refer?&nbsp; The installation instructions for it should say on which instance(s) it should be installed, but if you give us the name then we should be able to provide an answer.</P><P>Indexes, custom or otherwise, are always created on the indexers.&nbsp; For a better user experience, they should also be <STRONG>defined</STRONG> on search heads.&nbsp; Do that by deploying the same indexes.conf file to both instances, but without volume references on the SH.</P> Wed, 26 Jun 2024 17:41:01 GMT richgalloway 2024-06-26T17:41:01Z https://community.splunk.com/t5/Getting-Data-In/onboarding-of-cloudflare-with-splunk/m-p/691681#M115030 <P>Please guide on onboarding cloudflare with splunk for a distributed architecture.</P><P>along with information on, on which instance (HF, indexer, search heads, management instances) to install the add-ON, and on which instance to create custom index</P> Wed, 26 Jun 2024 14:28:55 GMT https://community.splunk.com/t5/Getting-Data-In/onboarding-of-cloudflare-with-splunk/m-p/691681#M115030 veeeeruuuu 2024-06-26T14:28:55Z https://community.splunk.com/t5/Getting-Data-In/onboarding-of-cloudflare-with-splunk/m-p/691719#M115037 <P>To which add-on do you refer?&nbsp; The installation instructions for it should say on which instance(s) it should be installed, but if you give us the name then we should be able to provide an answer.</P><P>Indexes, custom or otherwise, are always created on the indexers.&nbsp; For a better user experience, they should also be <STRONG>defined</STRONG> on search heads.&nbsp; Do that by deploying the same indexes.conf file to both instances, but without volume references on the SH.</P> Wed, 26 Jun 2024 17:41:01 GMT https://community.splunk.com/t5/Getting-Data-In/onboarding-of-cloudflare-with-splunk/m-p/691719#M115037 richgalloway 2024-06-26T17:41:01Z