Hello Team,
I am confused about SA , DA or TA as given in doc .
"Splunk Enterprise Security
The Splunk Enterprise Security package includes a set of add-ons.
The add-ons that include "SA-" or "DA-" in the name make up the Splunk Enterprise Security framework. You do not need to take any additional action to deploy or configure these add-ons, because their installation and setup is handled as part of the Splunk Enterprise Security installation process. Do not disable any add-ons that make up the Splunk Enterprise Security framework.
The rest of the add-ons include "TA-" in the name and are technology-specific and provide the CIM-compliant knowledge necessary to incorporate that source data into Enterprise Security.
There are three types of add-ons for Enterprise Security: domain add-ons (DAs), supporting add-ons (SAs), and technology add-ons (TAs). For example: https://dev.splunk.com/enterprise/docs/developapps/enterprisesecurity/abouttheessolution
What are you trying to do?