Is it possible to install and configure the Splunk Add-on for Amazon Web Services on a search head instead of a heavy forwarder?

[caglar]

I'm working on an existing Splunk environment where 1 Search Head and 2 Indexers are installed. Now I need to install the Splunk Add-on for Amazon Web Services. Should I install a heavy forwarder just for the AWS add-on? Or can I use Search Head which is not recommended and I'm getting this warning "Configuring this add-on on a search head is not best practice." What is the side effect of using Search Head for AWS add-on?

[rpille_splunk · Accepted solution]

Hi caglar, thanks for your question.

You can configure this add-on and collect your inputs on your search head, but doing so will impact your search performance. If you collect a very small amount of data with the add-on, this may not be a significant impact for you, but for best results, in a production environment, we strongly recommend that you configure inputs on forwarders, not on search heads.

This add-on requires heavy forwarders rather than universal forwarders because the configurations depend on Python and the setup and authentication are only supported using Splunk Web (neither of which comes with the universal forwarder.)