Splunk Enterprise Security

Where to install Phantom Remote Search

rtoloczk
Explorer

Does the Phantom Remote Search app get installed on my Enterprise Security Search Head, a HEC server, or another server all together? Seems there are search, HEC inputs, and index portions yet it's one app.

Thanks

brmitchell
Explorer

You must install the Splunk Phantom Remote Search app on your Splunk search heads or search head clusters, and on your indexers. See Install an add-on in a distributed Splunk Enterprise deployment in Splunk Supported Add-ons for additional information.
Installing the Splunk Phantom Remote Search app adds the necessary Splunk Phantom roles and indexes to your Splunk server.

ref: https://docs.splunk.com/Documentation/PhantomRemoteSearch/1.0.14/PhantomRemoteSearch/Connecttodistri...

0 Karma

CONSORP
Loves-to-Learn Lots

We need to install phantom remote search in HF

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...