The app looks very interesting.
We have a central deployment server that pushes out all the apps, to all Splunk compoenents.
Can you please give me some guidance on where I push this app out to - Indexers, forwarders or Search heads or all 3 ?
The description on the app's page says this:
Usually you would install it on the deployment server and have a firewall rule to open port 8089 on all forwarders etc from this server.
From your list of three choices the app would be most appropriate on a search head and useless on an indexer or forwarder.
View solution in original post
I have it on the deploy server. Any searchhead will do provided you have firewall rules that allow you to connect to the rest port of the forwarder (8089 by default but you can change it in the .conf).
Hope this helps.
Thank you @martin_mueller and @dominiquevocat
I will give this a try and let you know how it works out