Which apps can be installed on forwarders?

[racurrie]

Still learning the proper procedure, but which apps can I install on forwarders?

I've installed a few on the Splunk server, but I'm assuming now I have to copy those to $SPLUNK_HOME/etc/deployment_apps/ location to push them out to all the forwarders?

[woodcock · Accepted solution]

If you are talking about apps from Splunk Base (apps.splunk.com), then usually only the Technology Add-Ons (*-TA) apps. If you are talking about home-brew stuff, I usually create an app called mynewthing_inputs and put inputs.conf and props.conf in it and send that payload, assuming you are not using a Heavy Forwarder.

[racurrie]

Thank you!