All Apps and Add-ons

Palo Alto Networks Add-on Install Locations

KevinMurray
Explorer

If I have the add-on installed on my heavy forwarder and search heads, is there any need to install it on my indexers as well?????

Labels (1)
0 Karma

ivanreis
Builder

Hi @KevinMurray, in general we usually deploy the add-on on Heavy Forwarder with the inputs.conf setup and for Indexer and Search Head tier without inputs.conf setup. The add-on is being used to normalise data, using the props and transforms.conf, so it is really important to install them

In this particular case, the add-on has a document that highlight "Where to Install" and can be found here:
https://splunk.paloaltonetworks.com/installation.html

I am adding other document where you can have more information where to install Splunk add-ons

https://docs.splunk.com/Documentation/AddOns/released/Overview/Wheretoinstall

Usually the apps and add-ons from Splunk base does have a document with this type of information to assist with.

If this help, please upvote. 

0 Karma

KevinMurray
Explorer

I suspect the add-on is NOT needed on the indexers since I have the add-on with inputs.conf on the heavy forwarder, but, I am going to install it on the indexers anyway without the inputs.conf (obviously)

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...