Splunk Enterprise Security

How do I configure Splunk Enterprise Security in an indexer cluster?

New Member

I am not sure which Splunk ES related apps go where.

My deployment looks like the following:

Splunk universal forwarder (windows/linux/) + syslog ===> 2 Heavy Forwarders =====> 2 Indexers ======> 1 search head/master

I deployed the OS related TA app on the UF and the ES app config on the search head/mater. I am not sure where any of the SA or DA files need to go in addition to this.

Do i need to copy the app files into the indexers as well?

0 Karma


ES should be on a dedicated search head. It's too demanding of resources to share a box with adhoc searches and cluster master.

Yes, TAs need to be installed on the indexers.

If this reply helps you, an upvote would be appreciated.
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!