I have a lot of CEF Events in my Splunk Server and would like to install CEFUtils - Common Event Format Extraction Utilities. Normally decompress the file and place it in \Splunk\etc\apps. But I never know if I have to install it on the searchhead or on the indexer. Is there a way ... View more