topic Re: Splunk Enterprise Security & Transit Heavy-Forwarder in Splunk Enterprise Security

Splunk Enterprise Security & Transit Heavy-Forwarder

Splunker — Mon, 02 Jul 2012 13:23:47 GMT

Folks,

In the following Splunk installation [SH -> IDX -> Heavy-Forwarder -> Multiple UFs + Syslog]

Using Enterprise Security. I understand i need to install the main app on the SH, and TA- directories on the Indexers (technically any TA's that have index-time operations), do i also need to deploy the TA- apps on my transit Heavy-Forwarders as well?

I assume no, but thought i'd check to be sure..

Thanks.

Re: Splunk Enterprise Security & Transit Heavy-Forwarder

gkanapathy — Mon, 02 Jul 2012 14:30:49 GMT

Yes, you do actually. Some of the index-time operations will be performed there instead of on the indexer, so they will require that configurations. More info here: http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

Re: Splunk Enterprise Security & Transit Heavy-Forwarder

Splunker — Mon, 02 Jul 2012 20:24:17 GMT

Thanks gkanapathy. That makes sense. Another reason i should setup the deployment-server to keep it all in sync.