All Apps and Add-ons

What is the most preferred place to install DB Connect app ? Search Head or Heavy Forwarder ?


I am installing MS SQL Server Add-on. In the instructions, it mentions to install the DB Connect app on a Search head or Heavy Forwarder.
But I wish to know from least performance impacting perspective, which would be the best place to install ?
I am only interested in gathering the trace and audit logs, for which DB Connect app is required.

0 Karma

Super Champion

To use Splunk DB Connect in a distributed search environment, including search head clusters, you must determine the planned use cases. For ad hoc, interactive usage of database connections by live users, install the app on search head(s). For scheduled indexing from databases and output of data to databases, install the app on heavy forwarder(s).

For more info you can refer below link:

let me know if this helps!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!