There are multiple Stream apps in the Splunk store, which app goes where?

[ptur]

hello, trying to capture DNS log traffic from an Active Directory Domain Controller.

the topology is this: cloud splunk instance, heavy forwarder on my LAN and universal forwarder on the DC.

i  see multiple Stream apps in the splunk store - which app goes where? There is "Splunk App for Stream" then there's "Splunk Add-on for Stream Forwarders" then there's something called "Splunk Add-on for Stream Wire Data" - can you please help?

[scelikok]

Hi @ptur,

You can find information about where to install apps below;

• Splunk App for Stream (https://splunkbase.splunk.com/app/1809  Forwarder management, dashboards, calculators, and admin tools

• Splunk Add-on for Stream Wire Data (https://splunkbase.splunk.com/app/5234  Knowledge objects for parsing Stream data for use by users. Installed on Indexers and Search Heads.

• Splunk Add-on for Stream Forwarders (https://splunkbase.splunk.com/app/5238  Network data collection tools for capturing network data, interpreting protocols, extracting custom fields, and sending to Splunk. Installed on Splunk Universal or Heavy Forwarders.