Install this where?

[ajhstn]

Should this add-on be installed on my linux forwarder machines in addition to the main Splunk server?

[doksu]

Thanks very much for the question @ajhstn. I've updated the documentation to explicitly indicate that neither app should be installed on universal forwarders. Installing the TA on universal forwarders won't cause a problem, but there's no benefit in doing so.

[ajhstn]

Thank you @doksu 🙂

[493669 · Accepted solution]

Have a look at this detailed post about Installation and Configuration
https://github.com/doksu/splunk_auditd/wiki/Installation-and-Configuration