i am new to the distributed splunk environment. suppose if i want to install a add-on which collects data from the proofpoint where would i intsall it in the heavy forwarder or in the search head

[Nadhiya_Dubai]

where to install the TAP modular input in the distributed splunk environment . i have 4 heavy forwarders .How will i choose which heavy forwarder is the right place to install

[Nadhiya_Dubai]

when to configure the inputs ?? after pushing to the hf

[Nadhiya_Dubai]

i have a utility server with me where i had to copy the app conf files from splunk search head where my modular input app is installed

[ranjitbrhm1]

Apps are basically just conf files that you can put on the splunk server and you give splunk service a restart they will start working. So what i would have done in this setup is if you dont have a third party tool like sccm or scripts to push out your apps and you only have 4 HF and 1 SH you point all the HF to your SH first using the following command.

/opt/splunk/bin/splunk set deploy-poll "your SH IP address":8089

once that is done all you have to do is add the app on to your /opt/splunk/etc/deploymentapps folder and then create a server class and push them off to the HF. that way you can manage your apps better.

Of course i havent done it with your specific app but the concept remains the same. You can test it out with 1 server first and then try pushing it off to other servers

[Nadhiya_Dubai]

so to start with , is it advisable to directly install on the heavy forwarder or to install the app in the utility server . Later push the app to the heavy forwarder ?

[kmorris_splunk · Accepted solution]

The best practice would be to run it on a heavy forwarder. Generally, you don't want to use Search Heads for data collection.