Deploy CIM Add-On On Search Head Cluster

[AliMaher]

HI Everyone,

Hope you all are doing well.

I am trying to deploy the CIM on Search Head Cluster Environment, and I have some questions:

1- I found under /default two files (inputs.conf & indexes.conf) that seems to me they are related to indexer cluster not search heads cluster, am I true?

2- what is "cim_modactions index definition is used with the common action model alerts and auditing", i didnt know the actual meaning?

Splunk Common Information Model (CIM)  

[dural_yyz]

https://docs.splunk.com/Documentation/CIM/6.0.0/User/Install

There is still one outstanding index defined in the app as of the most recent install version.  You will need the index defined on the indexes, you can do this full app or custom app to the indexers.