Installation Question

[hainesa]

Attempting to install/configure the Splunk Add-on for Cisco ASA. Based on the README file, it isn’t clear to me where we need to install this app for our environment.

http://apps.splunk.com/app/1620/

In a distributed environment where Search Head and Indexer are on separate servers and ASAs dumping logs to a remote syslog server (also separate). The syslog server has the Splunk Universal Forwarder installed and forwards log data to Splunk.

The README is clear in that we need to install on the Search Head. My question is do we also install the app on the syslog server, the indexer, or both?

[rsennett_splunk]

This Add-on has components for search time (the search head) and index-time(the indexer and/or the forwarder) processing so basically there are parts of it that are required in both/all places.

Not knowing exactly how your deployment is set up, the short answer is... it can't hurt anything to install it on the search head, the indexer... and the forwarder.

Basically... the search head will take advantage of the search time field extractions, the tags, eventtypes, macros etc... the indexer will take advantage of any sourcetype assignments, and other transforms. Depending on how your deployment is set up, some of that might be happening on at the forwarder before it decides which indexer to send to (see the last bit of the readme for that) which means you want it on the forwarder.

There are some apps where each component is broken out further into TA or SA folders... in this case, it's all in one app.