Where does Splunk for Citrix NetScaler with AppFlow need to be installed in a distributed search environment and where can I specify a custom index?

[gn694]

In a distributed environment, where does Splunk for Citrix NetScaler with AppFlow need to be installed other than the Search Heads? Does it need to be installed on Intermediate Forwarders and/or Indexers?

Also, where can I specify an index other than netscaler to use for whatever things this app is attempting to index? We have a standard for the naming of indexes where they are all prefixed with a group name according to who is allowed access to the index. So I want to use an index named <group1>-netscaler. We already have this custom index created and configured for IPFIX inputs, but our indexers have been complaining since we installed this app "received event for unconfigured/disabled/deleted index='netscaler'"

I see in /default/macros.conf there is a stanza:
[ns_index]
definition = index=netscaler

Could I just create a macros.conf in /local and add the following (or would there be more involved to this...)
[ns_index]
definition = index=<group1>-netscaler

(As far as populating dashboards, I see in /default/eventtypes.conf there is a netscaler event type configured as index=netscaler. I have added an eventtypes.conf to the local folder setting it to be index=<group1>-netscaler.)

thank you

[jconger]

Depends on where you are sending your data from your NetScaler(s). If you are sending to the indexer(s), the Splunk_TA_Citrix-NetScaler needs to go on your indexers. If you are sending to an intermediate forwarder, then put it there instead.

You can modify the macros.conf and eventtypes.conf to specify your custom index.