All Apps and Add-ons

Do we need to install this add-on on indexers?

shubham87
Explorer

Please let me know if we need to install this add-on on our indexers? I have already installed same on Heavy forwarders and search head

0 Karma

jbrocks
Communicator

Reading the description of the Addon it is said that it will map data to the CIM, which means it has at least a props.conf - so I would install the Addon on an Indexer OR Heavy Forwarder and - if it does not seem to work - I would also try to install the Addon on the Search Head. Did you get any data and new fields as you tried installing at a Search Head and a heavy Forwarder?

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...