Splunk Enterprise Security & Transit Heavy-Forwarder

[Splunker]

Folks,

In the following Splunk installation [SH -> IDX -> Heavy-Forwarder -> Multiple UFs + Syslog]

Using Enterprise Security. I understand i need to install the main app on the SH, and TA- directories on the Indexers (technically any TA's that have index-time operations), do i also need to deploy the TA- apps on my transit Heavy-Forwarders as well?

I assume no, but thought i'd check to be sure..

Thanks.

[gkanapathy · Accepted solution]

Yes, you do actually. Some of the index-time operations will be performed there instead of on the indexer, so they will require that configurations. More info here: http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

[Splunker]

Thanks gkanapathy. That makes sense. Another reason i should setup the deployment-server to keep it all in sync.