Splunk Enterprise Security

How do I configure Splunk Enterprise Security in an indexer cluster?

New Member

I am not sure which Splunk ES related apps go where.

My deployment looks like the following:

Splunk universal forwarder (windows/linux/) + syslog ===> 2 Heavy Forwarders =====> 2 Indexers ======> 1 search head/master

I deployed the OS related TA app on the UF and the ES app config on the search head/mater. I am not sure where any of the SA or DA files need to go in addition to this.

Do i need to copy the app files into the indexers as well?

0 Karma


ES should be on a dedicated search head. It's too demanding of resources to share a box with adhoc searches and cluster master.

Yes, TAs need to be installed on the indexers.

If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...

Announcing Our Splunk MVPs

We are excited to announce the first cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...