For those of us with distributed clustered and multisite environments, where should this be deployed? Does it need to go on every peer node(indexer) , search heads?
For a non-distributed environment:
a. Single Instance Splunk Deployment i.e. SH + Indexer on the same server: PSC and MLTK should be both installed
b. 1 Search Head + 1 Indexer: PSC should be installed on both Search Head and Indexer (only if using streaming apply feature), while MLTK needs to be installed only on Search Head
For distributed search environment:
a. 1 Search Head + N Indexers: PSC should be installed on both Search Head and Indexers (only if using streaming apply feature), while MLTK needs to be installed only on Search Head
b. N Search Heads + N Indexers: PSC should be installed on all Search Heads and Indexers (only if using streaming apply feature), while MLTK needs to be installed only on all Search Heads
For Search Head Clustering - N Search Heads (part of Search Head Cluster) + M Indexers: PSC + MLTK should be installed via a deployer to the Search Head Cluster, in addition, PSC should be installed on all Indexers (only if using streaming apply feature).
To be clear, please note that customers are required to install PSC on Indexers ONLY if they want to use the streaming apply capability. By default, the streaming apply feature is turned off, so you’re not required to have PSC installed on all your indexers in the indexing cluster. For more details, read Use your indexers to apply models here -> https://docs.splunk.com/Documentation/MLApp/2.0.0/User/Installandconfigure
On the search heads, perhaps you might want to look at the Machine learning toolkit
The machine learning toolkit requires the python for scientific computing on the search heads where you want to use it...