Install ITE Work in a distributed environment
You can install IT Essentials Work (ITE Work) in any distributed Splunk Enterprise environment. Splunk Cloud Platform customers have to work with Support to install ITE Work. To file a ticket on the Splunk Support Portal, see Support and Services.
Where to install ITE Work in a distributed environment
|Splunk instance type||Supported||Required||Actions required|
|Search heads||Yes||Yes||Install ITE Work on all search heads. Search heads must be running a compatible version of Splunk Enterprise. For compatible versions, see the Splunk products version compatibility matrix.|
|Indexers||Yes||Yes||SA-IndexCreation is required on all indexers. For non-clustered distributed environments, copy SA-IndexCreation to $SPLUNK_HOME/etc/apps/ on individual indexers. Indexers must be running a compatible version of Splunk Enterprise. For compatible versions, see the Splunk products version compatibility matrix.|
|License master||Yes||Yes||Install SA-ITSI-Licensechecker and SA-UserAccess on any license master in a distributed or search head cluster environment. If a search head in your environment is also a license master, the license master components are installed when you install ITE Work on the search heads.|
|Heavy forwarders||Yes||No||The properties and transforms in SA-IndexCreation are required on heavy forwarders. Install the SA-ITSI-Licensechecker on any heavy forwarder.|
|Universal forwarders||Yes||No||ITE Work doesn't contain a data collection component.|
Distributed deployment feature compatibility
This table describes the compatibility of ITE Work with Splunk distributed deployment features.
|Distributed deployment feature||Supported||Actions required|
|Search head clusters||Yes||Use the deployer to distribute ITE Work to search head cluster members. Search heads must be running a compatible version of Splunk Enterprise. For detailed instructions, see Install ITE Work in a search head cluster environment.|
|Indexer clusters||Yes||Use the configuration bundle method to replicate SA-IndexCreation across all peer nodes. On the master node, place a copy of SA-IndexCreation in $SPLUNK_HOME/etc/master-apps/.|
|Deployment server||Yes||No actions required.|
Alongside ITSI or Splunk Enterprise Security
ITE Work can't be installed on the same search head as Splunk IT Service Intelligence (ITSI) or Splunk Enterprise Security.
Install Splunk IT Essentials Work on a single on-premises instance
Install ITE Work in a search head cluster environment
This documentation applies to the following versions of Splunk® IT Essentials Work: 4.9.0, 4.9.1, 4.9.2, 4.9.3, 4.9.4, 4.9.5, 4.9.6, 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.6, 4.13.0, 4.13.1, 4.13.2, 4.13.3