Does the Phantom Remote Search app get installed on my Enterprise Security Search Head, a HEC server, or another server all together? Seems there are search, HEC inputs, and index portions yet it's one app.
You must install the Splunk Phantom Remote Search app on your Splunk search heads or search head clusters, and on your indexers. See Install an add-on in a distributed Splunk Enterprise deployment in Splunk Supported Add-ons for additional information.
Installing the Splunk Phantom Remote Search app adds the necessary Splunk Phantom roles and indexes to your Splunk server.
