Index_utilization_summary Index and 7.3.x

[cboillot]

Two questions.

1. Does the index_utilization_summary index go on the search head or the indexers?
2. Does the current version (2.2.1) support Splunk 7.3.x?

[solarboyz1 · Accepted solution]

1. Does the index_utilization_summary index go on the search head or the indexers?

Indexes live on the indexers. Your search heads should be configured to forward event to the indexers.

2. Does the current version (2.2.1) support Splunk 7.3.x?

Offhand, I don't know of any changes between 7.2 -> 7.3 that would impact this app. However, I can't verify.