Where to install an app?

[bkcarter]

One of the challenges I am finding with Splunk is WHERE to install the different pieces. I have an environment with Indexer, Search Heads, multiple forwarders of various types including Universal Forwarders. Where would this app Splunk for Unix/Linux) be installed at? Search Head? Indexer? All of the above? Please clarify for me. Thanks

[BobM]

The simple answer is the main app "Splunk for Unix and Linux" goes on the search head and "Splunk for Unix and Linux technology add-on" goes on the indexers and any forwarders collecting Unix/Linux data.

[malmoore]

Hi Bkcarter (and sowings):

We're updating the Unix app documentation to help reduce confusion and the presumption that Unix App users will automatically know where everything goes. The next version of the Unix App docs will have extensive information on how to deploy the app in distributed environments, cross-platform compatibility, and more. This version will initially get deployment location info.

While we can't possibly document every potential use case for these apps and add-ons, your feedback helps us ensure that the most relevant ones have representation.

[sowings]

And the Windows app complains when it's run on a Linux search head! You can safely ignore that error (and rest assured that it's going away when the apps are updated).

The general rule is that a "Technology Add-On" may contain rules for parsing and / or data collection, and will therefore need to go on non search head machines (that would include indexers and forwarders, such as user desktops).

The app itself will search against the data collected by the TA to provide meaning from the content.

The application README should (hopefully) spell this out.

[bkcarter]

Thank you. I can find a lot of documentation on Apps and add-ons, but I have yet to see something that explains what should go where and why. One of the challenges with Splunk is that it is so flexible, and all of the documentation just assumes that you know where everything goes.

So my Search Head is a Windows machine and my Indexer is Linux. When I install the app on the Head it complains that it is not a Linux box. This confuses me even more.