Installing Website Monitoring on Distributed Environment

[sramiz]

hello,

We have one searchhead and one indexer server running on separate VMs. wondering where should we install website monitoring application? any tip or advise is much appreciated.

regards,
SR

[jwiedow]

@sramiz , you will actually want the Website Monitoring App installed on a Heavy Forwarder; as @richgalloway indicated, AND your searchhead. The app on the searchhead will provide the visualizations for the results coming out of your indexed data. You need to make sure that the permissions for Data Inputs is set so that noone is able to create a new web_ping input on your searchhead and you are managing those on your Heavy Forwarder.

[richgalloway · Accepted solution]

None of the above. See https://docs.splunk.com/Documentation/AddOns/released/Overview/Wheretoinstall . Apps that define inputs should be installed on a forwarder (heavy forwarder in your case). If you don't want to or can't create a HF, install the app on the indexer. Be aware that the input will affect the performance of the indexer.

[sramiz]

thank you for clarification