Hi,  You can install Splunk_TA_Windows on search head by removing the inputs.conf file for managing KOs & other Search time functionalities. Refer the below documentation: https://docs.splunk.com/Documentation/AddOns/released/Windows/Install#Distributed_deployment_feature_compatibility You can install this add-on on a search head cluster for all search-time functionality, but configure inputs on forwarders to avoid duplicate data collection. Before you install this add-on to a cluster, make the following changes to the add-on package: Remove the inputs.conf file. ... View more