Getting Data In

Which apps can be installed on forwarders?

racurrie
New Member

Still learning the proper procedure, but which apps can I install on forwarders?

I've installed a few on the Splunk server, but I'm assuming now I have to copy those to $SPLUNK_HOME/etc/deployment_apps/ location to push them out to all the forwarders?

0 Karma
1 Solution

woodcock
Esteemed Legend

If you are talking about apps from Splunk Base (apps.splunk.com), then usually only the Technology Add-Ons (*-TA) apps. If you are talking about home-brew stuff, I usually create an app called mynewthing_inputs and put inputs.conf and props.conf in it and send that payload, assuming you are not using a Heavy Forwarder.

View solution in original post

woodcock
Esteemed Legend

If you are talking about apps from Splunk Base (apps.splunk.com), then usually only the Technology Add-Ons (*-TA) apps. If you are talking about home-brew stuff, I usually create an app called mynewthing_inputs and put inputs.conf and props.conf in it and send that payload, assuming you are not using a Heavy Forwarder.

racurrie
New Member

Thank you!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...