Firstly, learn what is in the app. If it's a Splunk-supported add-on, it should have a fairly well written installation instructions containing, among other things, specification of where to install the add-on and how to configure it. If it's an independently developed one - well, you're more or less on your own. There are some good practices and conventions but not everyone follows them. For example, a good practice would be to define modular inputs as disabled by default so the app itself can be easily distributed to all tiers and the input would only need to be enabled where it's needed. But I've seen apps which came with modular inputs enabled by default so you have to be watchful. I never install third-party apps in productio without a thorough review of its content. A well-written app would be pretty ok with being installed on all tiers (UF, possible intermedate forwarder, indexer, search head). Settings unneeded at given layer (like search-time extractions on indexers or parsing settings on UF) would simply get ignored. Things that could be problematic are the ones that modify the "state" of the environment like said modular inputs, index definitions, scheduled searches.
... View more
