does the Cisco ASA TA get installed on the indexer or the search head?

[lbogle]

Hello,
Does this TA get installed on the Indexer or the Search Head?

[sbrant_splunk]

It actually would go on both, on the indexer for capture of data from universal forwarders and on search heads for field extraction.

[aelliott · Accepted solution]

Both,
This add-on provides the index-time and search-time knowledge for system log data from Cisco ASA etc..