Splunk Enterprise Security

Which configs go on the indexer and which go on the search head for the Splunk App for Enterprise Security in a distributed search environment?


For the Splunk App for Enterprise Security, Is there any documentation that will tell me which config files should go on the indexer and which should go on the search head in a distributed environment?

0 Karma


Why, yes there is an Install Manual.


Read it through entirely before attempting an Install. ES is a tricky beast at times, and if you are new to ES or Splunk, you may want to contact Splunk PS.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...