Where do I deploy the ta-forwarderquery app

[msudhindra]

Hi,

The app looks very interesting.
We have a central deployment server that pushes out all the apps, to all Splunk compoenents.

Can you please give me some guidance on where I push this app out to - Indexers, forwarders or Search heads or all 3 ?

Thanks,
Madan Sudhindra

[dominiquevocat]

I have it on the deploy server. Any searchhead will do provided you have firewall rules that allow you to connect to the rest port of the forwarder (8089 by default but you can change it in the .conf).

Hope this helps.

[martin_mueller · Accepted solution]

The description on the app's page says this:

Usually you would install it on the deployment server and have a firewall rule to open port 8089 on all forwarders etc from this server.

https://splunkbase.splunk.com/app/2775/

From your list of three choices the app would be most appropriate on a search head and useless on an indexer or forwarder.

[msudhindra]

Thank you @martin_mueller and @dominiquevocat

I will give this a try and let you know how it works out

Thanks,
Madan