Getting Data In

What is the difference between installing an add-on at the search head and the indexer?

borja_luaces
New Member

Hi all,

I was going to install the Linux Secure Technology Add-On and the installation says that it needs to be installed at the search head.

It might be a simple question but, was wondering, what is the difference between installing the add-on in the search head and the indexer?

Regards

0 Karma

woodcock
Esteemed Legend

This is a very difficult question to answer definitively but thankfully there is a short-hand rule-of-thumb that is easy and almost always works. Install any *-On for * app everywhere (except UFs) and isntall any * App for * on your Search Head(s). Yes, it is that simple.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...