If I have the add-on installed on my heavy forwarder and search heads, is there any need to install it on my indexers as well?????
Hi @KevinMurray, in general we usually deploy the add-on on Heavy Forwarder with the inputs.conf setup and for Indexer and Search Head tier without inputs.conf setup. The add-on is being used to normalise data, using the props and transforms.conf, so it is really important to install them
In this particular case, the add-on has a document that highlight "Where to Install" and can be found here:
https://splunk.paloaltonetworks.com/installation.html
I am adding other document where you can have more information where to install Splunk add-ons
https://docs.splunk.com/Documentation/AddOns/released/Overview/Wheretoinstall
Usually the apps and add-ons from Splunk base does have a document with this type of information to assist with.
If this help, please upvote.
I suspect the add-on is NOT needed on the indexers since I have the add-on with inputs.conf on the heavy forwarder, but, I am going to install it on the indexers anyway without the inputs.conf (obviously)