Splunk® IT Essentials Work

Install of Splunk IT Essentials Work

Acrobat logo Download manual as PDF


This documentation does not apply to the most recent version of ITEWork. Click here for the latest version.
Acrobat logo Download topic as PDF

Install ITE Work in a distributed environment

You can install IT Essentials Work (ITE Work) in any distributed Splunk Enterprise environment. Splunk Cloud Platform customers have to work with Support to install ITE Work. To file a ticket on the Splunk Support Portal, see Support and Services.

Where to install ITE Work in a distributed environment

Splunk instance type Supported Required Actions required
Search heads Yes Yes Install ITE Work on all search heads. Search heads must be running a compatible version of Splunk Enterprise. For compatible versions, see the Splunk products version compatibility matrix.
Indexers Yes Yes SA-IndexCreation is required on all indexers. For non-clustered distributed environments, copy SA-IndexCreation to $SPLUNK_HOME/etc/apps/ on individual indexers. Indexers must be running a compatible version of Splunk Enterprise. For compatible versions, see the Splunk products version compatibility matrix.
License master Yes Yes Install SA-ITSI-Licensechecker and SA-UserAccess on any license master in a distributed or search head cluster environment. If a search head in your environment is also a license master, the license master components are installed when you install ITE Work on the search heads.
Heavy forwarders Yes No The properties and transforms in SA-IndexCreation are required on heavy forwarders. Install the SA-ITSI-Licensechecker on any heavy forwarder.
Universal forwarders Yes No ITE Work doesn't contain a data collection component.

Distributed deployment feature compatibility

This table describes the compatibility of ITE Work with Splunk distributed deployment features.

Distributed deployment feature Supported Actions required
Search head clusters Yes Use the deployer to distribute ITE Work to search head cluster members. Search heads must be running a compatible version of Splunk Enterprise. For detailed instructions, see Install ITE Work in a search head cluster environment.
Indexer clusters Yes Use the configuration bundle method to replicate SA-IndexCreation across all peer nodes. On the master node, place a copy of SA-IndexCreation in $SPLUNK_HOME/etc/master-apps/.
Deployment server Yes No actions required.

Alongside ITSI or Splunk Enterprise Security

ITE Work can't be installed on the same search head as Splunk IT Service Intelligence (ITSI) or Splunk Enterprise Security.

Last modified on 15 June, 2022
PREVIOUS
Install Splunk IT Essentials Work on a single on-premises instance
  NEXT
Install ITE Work in a search head cluster environment

This documentation applies to the following versions of Splunk® IT Essentials Work: 4.9.0, 4.9.1, 4.9.2, 4.9.3, 4.9.4, 4.9.5, 4.9.6, 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.6, 4.13.0, 4.13.1


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters