Splunk Enterprise Security: How to deploy the included add-ons to forwarders?

[shubham87]

I have recently deployed Splunk Enterprise Security (ES) on one of our Search Heads. While installing, it could not proceed, since I had two add-ons already installed (Splunk Add-on for Microsoft Windows and Splunk Add-on for Tenable) using my deployment server. I removed those add-ons from the deployment server and I was able to install ES. Now, one section in ES documentation says, "Deploy add-ons included with Splunk Enterprise Security": http://docs.splunk.com/Documentation/ES/4.7.2/Install/InstallTechnologyAdd-ons

Now my question is, how should i deploy these add-ons to my forwarders? Shall i use deployment server to deploy them? Or it conflicts with ES? I am confused.

Regards
Shubham

[rpille_splunk]

Hi Shubham,
That documentation page that you were following is the right one to have open while you work through the deployment process. Follow the links to the pages about deploying add-ons in a distributed environment, and also review the documentation (or, if no online documentation is available, read the readme files) of each add-on to determine where you need to deploy it and any limitations about how you should do so. Each add-on is different, so you need to read each doc for each add-on.