is it possible to install other Splunk Apps (CIM compliant and non compliant) on the same search head which contains Enterprise security ?

[mohammedsamir]

If it isn't possible to install other apps that aren't CIM Compliant on the Sh machine that has the Enterprise security (5) what would happen if i did it by mistake ?

Also is it generally recommended to install other apps with the Enterprise security (5) app on the same machine rather than the CIM APP ?

[richgalloway]

Yes, it is possible to install other apps on your ES search head. It's discouraged, however, since ES is resource-hungry and running additional apps can limit the resources available to ES. If your search head is sufficiently powerful, however, this may not be a problem.

[mohammedsamir]

Are you sure that no conflicts will happen with all other apps even if they aren't CIM compliant assuming minimum hardware specs are achieved and even more.
(I mean by conflicts if other Apps are using same saved searches, defined eventtypes , saved reports like ES)

[richgalloway]

I cannot guarantee no conflicts will happen, but it's fairly unlikely. That is what test instances are for, however.

[smoir_splunk]

The other risk besides performance is literal app collisions, like another app using an app named SA-Utils that might break ES functionality. ES uses app imports to prevent some of the risks you mention, @mohammedsamir, but the conflicting SA-Utils app issue is one that exists with some apps.