Getting Data In

What is the difference between installing an add-on at the search head and the indexer?

borja_luaces
New Member

Hi all,

I was going to install the Linux Secure Technology Add-On and the installation says that it needs to be installed at the search head.

It might be a simple question but, was wondering, what is the difference between installing the add-on in the search head and the indexer?

Regards

0 Karma

woodcock
Esteemed Legend

This is a very difficult question to answer definitively but thankfully there is a short-hand rule-of-thumb that is easy and almost always works. Install any *-On for * app everywhere (except UFs) and isntall any * App for * on your Search Head(s). Yes, it is that simple.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Observability - October 2025

What’s New?  We’re excited to announce the latest enhancements to Splunk Observability Cloud and share what’s ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened Audit Trail v2 wasn’t written in isolation—it was shaped by your voices. In ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...