Do we need to install all apps for indexers in cluster ?

[AKG1_old1]

Hello,

We are planning to move from Single instance installation to cluster(1SH + 3 INDEXER)

we have 50+ supporting apps downloaded from splunkbase. We use one primary app which has all the main configuration like props, transform, dashboards, datamodels etc. we will be distributing this primary app to indexer using configuration bundle.

I wanted to know if we need to push all other supporting appls like Lookup Editor, Calender_App etc ?
As per my understanding these supporting app/add-on only be used on search head. so do I need to push these to all indexer ?

example:

Thanks

[gcusello]

Hi @AKG1_old1,

if you're speaking of apps like  Lookup Editor, Calender_App, etc, in other words apps only for presentation, you don't need to install them on Indexers.

It's a different thing for the TAs, especially the ones required by some special App, e.g. the Splunk App for windows Infrastructure requires TA_Windows, Splunk Add-On for Microsoft Active Directory, Splunk Add-On for Microsoft DNS, etc...

In other words you have to see in the documentation if there are Indexes components.

All these apps must be deployed by the Master Node.

Ciao.

Giuseppe

[AKG1_old1]

Thank you @gcusello . I  have better understading now. 

After reading your reply I think  I do have some other apps which may need to deploy on Indexer.

You mentioned that we can verify these apps in doucments if has indexer components or not. Could you give little more insight how I can verify my all apps. 

Thank you

[gcusello · Accepted solution]

Hi @AKG1_old1.,

you can see in apps.splunk.com and check, one by one, in the documentation section of each app, if there's an Indexer component.

Anyway, I'd install on Indexers all the TAs.

Ciao.

Giuseppe

P.S.: if this answer solves your needs, please accept it for the other people of Community and Karma Points are appreciated 😉