install splunk app for zscaler in a distributed environment

[jeandez]

Hi !!
I want to installsplunk app for zscaler in a distributed environment.
I have search head, indexer and forwarders.
when i install splunk app for zscaler on search head, zscalerlogs index is created on the search head. so that i can't index zscaler log on the indexer.
i want Splunk app for zscaler on my search head, and the index on my indexer. So that , i don't have to index zscaler log on my search head, but i can make search with the app on my search head.

what are the best practices to install splunk app for zscaler in a distributed environment ??

thank you...

[lakshman239]

You can still create the index on the distributed indexers ( You can then delete the indexes.conf on the search head or leave it as it doesn't do any harm). Ensure your indexers listen to the stream of logs from Zscaler on the required TCP port. Also, you can move or copy the props.conf and transforms.conf on to the indexers. If you want to keep the search time knowledge objects (e.g. EVAL/transforms/field alias), you could have them only on the search head.