Hi @himaniarora20 , answering to your questions: the custom Add-On must be located in every Forwarder. If you have an already configured Deployment Server, you can load it in the DS and deploy it ...
See more...
Hi @himaniarora20 , answering to your questions: the custom Add-On must be located in every Forwarder. If you have an already configured Deployment Server, you can load it in the DS and deploy it using the DS, but to be useful, you have also to remove the old conf files from the $SPLUNK_HOME/etc/system/local folder. Otherwise the old conf files will con tinue to have precedence on the new ones. Indexer Discovery, as you can read in the url I shared, must be configured in the outputs.conf file that must be located in the TA_Forwarders Add-On. So it doesn't must be installed on the DS, but deployed to all the Forwarders using the DS. Before starting this job, I hint to follow a training for Splunk Admin or engage a Splunk Admin (better an Architect), to assess your infrastructure, don't start your job without an adequate preparation! Ciao. Giuseppe