Install ITE Work in a distributed environment

You can install IT Essentials Work (ITE Work) in any distributed Splunk Enterprise environment. Splunk Cloud Platform customers have to work with Support to install ITE Work. To file a ticket on the Splunk Support Portal, see Support and Services.

Where to install ITE Work in a distributed environment

Splunk instance type	Supported	Required	Actions required
Search heads	Yes	Yes	Install ITE Work on all search heads. Search heads must be running a compatible version of Splunk Enterprise. For compatible versions, see the Splunk products version compatibility matrix.
Indexers	Yes	Yes	SA-IndexCreation is required on all indexers. For non-clustered distributed environments, copy SA-IndexCreation to $SPLUNK_HOME/etc/apps/ on individual indexers. Indexers must be running a compatible version of Splunk Enterprise. For compatible versions, see the Splunk products version compatibility matrix.
License master	Yes	Yes	Install SA-ITSI-Licensechecker and SA-UserAccess on any license master in a distributed or search head cluster environment. If a search head in your environment is also a license master, the license master components are installed when you install ITE Work on the search heads.
Heavy forwarders	Yes	No	The properties and transforms in SA-IndexCreation are required on heavy forwarders. Install the SA-ITSI-Licensechecker on any heavy forwarder.
Universal forwarders	Yes	No	ITE Work doesn't contain a data collection component.

Distributed deployment feature compatibility

This table describes the compatibility of ITE Work with Splunk distributed deployment features.

Distributed deployment feature	Supported	Actions required
Search head clusters	Yes	Use the deployer to distribute ITE Work to search head cluster members. Search heads must be running a compatible version of Splunk Enterprise. For detailed instructions, see Install ITE Work in a search head cluster environment.
Indexer clusters	Yes	Use the configuration bundle method to replicate SA-IndexCreation across all peer nodes. On the master node, place a copy of SA-IndexCreation in $SPLUNK_HOME/etc/master-apps/.
Deployment server	Yes	No actions required.

Alongside ITSI or Splunk Enterprise Security

ITE Work can't be installed on the same search head as Splunk IT Service Intelligence (ITSI) or Splunk Enterprise Security.