All Apps and Add-ons

install splunk app for zscaler in a distributed environment


Hi !!
I want to installsplunk app for zscaler in a distributed environment.
I have search head, indexer and forwarders.
when i install splunk app for zscaler on search head, zscalerlogs index is created on the search head. so that i can't index zscaler log on the indexer.
i want Splunk app for zscaler on my search head, and the index on my indexer. So that , i don't have to index zscaler log on my search head, but i can make search with the app on my search head.

what are the best practices to install splunk app for zscaler in a distributed environment ??

thank you...

Tags (4)
0 Karma


You can still create the index on the distributed indexers ( You can then delete the indexes.conf on the search head or leave it as it doesn't do any harm). Ensure your indexers listen to the stream of logs from Zscaler on the required TCP port. Also, you can move or copy the props.conf and transforms.conf on to the indexers. If you want to keep the search time knowledge objects (e.g. EVAL/transforms/field alias), you could have them only on the search head.

0 Karma
Get Updates on the Splunk Community!

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...