All Apps and Add-ons

install splunk app for zscaler in a distributed environment

jeandez
Explorer

Hi !!
I want to installsplunk app for zscaler in a distributed environment.
I have search head, indexer and forwarders.
when i install splunk app for zscaler on search head, zscalerlogs index is created on the search head. so that i can't index zscaler log on the indexer.
i want Splunk app for zscaler on my search head, and the index on my indexer. So that , i don't have to index zscaler log on my search head, but i can make search with the app on my search head.

what are the best practices to install splunk app for zscaler in a distributed environment ??

thank you...

Tags (4)
0 Karma

lakshman239
Influencer

You can still create the index on the distributed indexers ( You can then delete the indexes.conf on the search head or leave it as it doesn't do any harm). Ensure your indexers listen to the stream of logs from Zscaler on the required TCP port. Also, you can move or copy the props.conf and transforms.conf on to the indexers. If you want to keep the search time knowledge objects (e.g. EVAL/transforms/field alias), you could have them only on the search head.

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...