Splunk Enterprise Security

Where to install Phantom Remote Search


Does the Phantom Remote Search app get installed on my Enterprise Security Search Head, a HEC server, or another server all together? Seems there are search, HEC inputs, and index portions yet it's one app.



You must install the Splunk Phantom Remote Search app on your Splunk search heads or search head clusters, and on your indexers. See Install an add-on in a distributed Splunk Enterprise deployment in Splunk Supported Add-ons for additional information.
Installing the Splunk Phantom Remote Search app adds the necessary Splunk Phantom roles and indexes to your Splunk server.

ref: https://docs.splunk.com/Documentation/PhantomRemoteSearch/1.0.14/PhantomRemoteSearch/Connecttodistri...

0 Karma

Loves-to-Learn Lots

We need to install phantom remote search in HF

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...