Hi, I'd like to install the Tripwire Enterprise app on one of my Search Heads. I do not want the logs to be stored locally since it is a search head. The logs should be pushed to my indexers, preferably load balanced. So my question is this, given that the app will be installed on a search head, would it be best to install a universal forwarder on the tripwire console server, then configure the outputs.conf files to send to my indexers? Given the question i've just asked, can I also configure the Tripwire Data Directory to point to the essentially load balanced indexers when I setup the app? Or is there a better way to accomplish all of this? The installation instruction does not mention any of this.
