Solved: Re: SolarWinds Add-on for Splunk

sh_tavousi · ‎02-08-2021

I want to know where should we install "SolarWinds Add-on Splunk", I mean on deployment server, search head or indexers? Also I want to know if this Add-on can get logs like when they are sent from syslog server.

richgalloway · ‎02-08-2021

Like most TAs, it should be installed on indexers so index-time properties and transforms can be used. It should also be installed on search heads so search-time properties can be used. Do NOT enable inputs in either instance type.

To use the inputs feature of the app, install it on a heavy forwarder.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway · ‎02-08-2021

Like most TAs, it should be installed on indexers so index-time properties and transforms can be used. It should also be installed on search heads so search-time properties can be used. Do NOT enable inputs in either instance type.

To use the inputs feature of the app, install it on a heavy forwarder.

---
If this reply helps you, Karma would be appreciated.

SolarWinds Add-on for Splunk

administration

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Build and Launch AI Agents from Your Splunk Workflows

index This | What kind of room has no doors?

Join the Conversation