All Apps and Add-ons

install splunk app for zscaler in a distributed environment

jeandez
Explorer

Hi !!
I want to installsplunk app for zscaler in a distributed environment.
I have search head, indexer and forwarders.
when i install splunk app for zscaler on search head, zscalerlogs index is created on the search head. so that i can't index zscaler log on the indexer.
i want Splunk app for zscaler on my search head, and the index on my indexer. So that , i don't have to index zscaler log on my search head, but i can make search with the app on my search head.

what are the best practices to install splunk app for zscaler in a distributed environment ??

thank you...

Tags (4)
0 Karma

lakshman239
Influencer

You can still create the index on the distributed indexers ( You can then delete the indexes.conf on the search head or leave it as it doesn't do any harm). Ensure your indexers listen to the stream of logs from Zscaler on the required TCP port. Also, you can move or copy the props.conf and transforms.conf on to the indexers. If you want to keep the search time knowledge objects (e.g. EVAL/transforms/field alias), you could have them only on the search head.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...