How do you install Blue Coat ProxySG App for Splunk in a Distributed environment?

[sbmac3]

The installation instructions I have read are for standalone. What are the installation instructions for a distributed Splunk Enterprise environment? Does the app need to be installed on search heads, indexers, and/or forwarders?

[hunters_splunk]

Hi sbmac3,

Yes, in a distributed deployment, you need to stall the Splunk Add-on for Blue Coat ProxySG to your search heads, indexers, and forwarders. If you are using heavy forwarders to collect data with this add-on, the index-time operations occur there, so you do not need to install the add-on to your indexers in this deployment scenario.

For more details, see here:
http://docs.splunk.com/Documentation/AddOns/released/BlueCoatProxySG/Install

Hope this helps. Thanks!
Hunter