Palo Alto Networks Add-on Install Locations

[KevinMurray]

If I have the add-on installed on my heavy forwarder and search heads, is there any need to install it on my indexers as well?????

[ivanreis]

Hi @KevinMurray, in general we usually deploy the add-on on Heavy Forwarder with the inputs.conf setup and for Indexer and Search Head tier without inputs.conf setup. The add-on is being used to normalise data, using the props and transforms.conf, so it is really important to install them

In this particular case, the add-on has a document that highlight "Where to Install" and can be found here:
https://splunk.paloaltonetworks.com/installation.html

I am adding other document where you can have more information where to install Splunk add-ons

https://docs.splunk.com/Documentation/AddOns/released/Overview/Wheretoinstall

Usually the apps and add-ons from Splunk base does have a document with this type of information to assist with.

If this help, please upvote. 

[KevinMurray]

I suspect the add-on is NOT needed on the indexers since I have the add-on with inputs.conf on the heavy forwarder, but, I am going to install it on the indexers anyway without the inputs.conf (obviously)