Splunk Enterprise Security

Which configs go on the indexer and which go on the search head for the Splunk App for Enterprise Security in a distributed search environment?

jamesvz84
Communicator

For the Splunk App for Enterprise Security, Is there any documentation that will tell me which config files should go on the indexer and which should go on the search head in a distributed environment?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Why, yes there is an Install Manual.

http://docs.splunk.com/Documentation/ES/3.3.1/Install/Overview

Read it through entirely before attempting an Install. ES is a tricky beast at times, and if you are new to ES or Splunk, you may want to contact Splunk PS.

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!