Where to install Phantom Remote Search

[rtoloczk]

Does the Phantom Remote Search app get installed on my Enterprise Security Search Head, a HEC server, or another server all together? Seems there are search, HEC inputs, and index portions yet it's one app.

Thanks

[brmitchell]

You must install the Splunk Phantom Remote Search app on your Splunk search heads or search head clusters, and on your indexers. See Install an add-on in a distributed Splunk Enterprise deployment in Splunk Supported Add-ons for additional information.
Installing the Splunk Phantom Remote Search app adds the necessary Splunk Phantom roles and indexes to your Splunk server.

ref: https://docs.splunk.com/Documentation/PhantomRemoteSearch/1.0.14/PhantomRemoteSearch/Connecttodistri...

[CONSORP]

We need to install phantom remote search in HF