Solved: SolarWinds Add-on for Splunk

sh_tavousi · ‎02-08-2021

I want to know where should we install "SolarWinds Add-on Splunk", I mean on deployment server, search head or indexers? Also I want to know if this Add-on can get logs like when they are sent from syslog server.

richgalloway · ‎02-08-2021

Like most TAs, it should be installed on indexers so index-time properties and transforms can be used. It should also be installed on search heads so search-time properties can be used. Do NOT enable inputs in either instance type.

To use the inputs feature of the app, install it on a heavy forwarder.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway · ‎02-08-2021

Like most TAs, it should be installed on indexers so index-time properties and transforms can be used. It should also be installed on search heads so search-time properties can be used. Do NOT enable inputs in either instance type.

To use the inputs feature of the app, install it on a heavy forwarder.

---
If this reply helps you, Karma would be appreciated.

SolarWinds Add-on for Splunk

administration

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: State of Observability - Where AI Meets Performance

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Join the Conversation