Splunk Enterprise Security
Highlighted

Where to install Phantom Remote Search

Explorer

Does the Phantom Remote Search app get installed on my Enterprise Security Search Head, a HEC server, or another server all together? Seems there are search, HEC inputs, and index portions yet it's one app.

Thanks

Highlighted

Re: Where to install Phantom Remote Search

New Member

We need to install phantom remote search in HF

0 Karma
Highlighted

Re: Where to install Phantom Remote Search

Engager

You must install the Splunk Phantom Remote Search app on your Splunk search heads or search head clusters, and on your indexers. See Install an add-on in a distributed Splunk Enterprise deployment in Splunk Supported Add-ons for additional information.
Installing the Splunk Phantom Remote Search app adds the necessary Splunk Phantom roles and indexes to your Splunk server.

ref: https://docs.splunk.com/Documentation/PhantomRemoteSearch/1.0.14/PhantomRemoteSearch/Connecttodistri...

0 Karma