Where shoulld I install Azure Monitor Add-on For Splunk? (Heavy forwarder/indexer/Search head)?

[Koko12345678]

HI ,

I would like to know where should I install the Azure Monitor Add-on For Splunk? on which of this component? Heavy forwarder, indexer , Search head?

Thanks

[adonio · Accepted solution]

Hello there,

ideally on the Heavy Forwarder, if not in the Search Head.
Avoid installing on indexer (unless its all in one)

hope it helps

[Koko12345678]

thanks 🙂
can you please explain why it's Ideally to install it on the HF ? and why to avoid installing it on the Indexer? and what do you mean by "unless its all in one"?

thank you

[thambisetty]

Hi,

Better to install on HF.

Because INDEXER IS BUSY IN indexing data.
Search head is busy in searching.

[Koko12345678]

as far as I know HF is busy in parsing the data,then I'm just asking myself why HF is the better place?
in addition, where Should I configure the Inputs( input for Activity Logs/Diagnostics Logs) in splunk? is it in the search head?

[thambisetty]

Its fully dependent on your environment.

In my case we have search heads loaded with so many scheduled searches so I could not allocate even 1 cpu for modular/scripted inputs and we have Indexers are busy in responding to searches and indexing data. Thats y I recommend to have modular inputs on HF.

[Koko12345678]

ok thanks 🙂