Install and upgrade the Splunk Phantom Remote Search app
Install the Splunk Phantom Remote Search app on your Splunk search heads or search head clusters, and on your indexers. Installing the Splunk Phantom Remote Search app adds the necessary Splunk Phantom roles and indexes to your Splunk server.
Use the tables below to determine where and how to install the Splunk Phantom Remote Search app in a Splunk Enterprise deployment.
Where to install the app in a distributed deployment
Use the table to determine where to install the app in a Splunk Enterprise distributed deployment.
Splunk instance type | Can the app be installed here? | Comments |
---|---|---|
Search Heads | Yes | Install this app on the search head. |
Indexers | Yes | The app contains indexes or index-time transformations. |
Forwarders | No | The app does not contain inputs for forwarder data collection. |
Distributed deployment compatibility
Use the table to check the compatibility of the app with Splunk Enterprise distributed deployment features.
Distributed deployment feature | Supported | Comments |
---|---|---|
Search Head Clusters | Yes | Use the search head cluster deployer to distribute apps across search head cluster members. See Use the deployer to distribute apps and configuration updates in the Splunk Enterprise Distributed Search manual. |
Indexer Clusters | Yes | The app contains indexes or index-time transformations. |
Deployment Server | No | The app does not contain inputs for forwarder data collection. |
Install or upgrade the app using Splunk Web
- Log in to the Splunk Enterprise search head.
- On the Applications menu, scroll to the bottom and select Find More Apps.
- On the Browse more apps page, locate the app in the list, or type the name in the search box.
- Provide your splunk.com credentials.
- Accept the license terms.
- (Optional) Click Upgrade app if you want to overwrite the existing installation.
- Click Login and Install.
- Click Done.
Install or upgrade the app from a downloaded file
- Log in to splunkbase.splunk.com.
- Download the Splunk Phantom Remote Search app and save it to an accessible location.
- Log in to the Splunk Enterprise search head.
- On the Applications menu, select the Mange Apps () icon.
- On the Apps page, click Install app from file.
- On the Upload app page, click the Choose file button to locate the app.
- (Optional) Click Upgrade app to overwrite the existing installation.
- Click Upload.
- Click Done.
PREVIOUS About the Splunk Phantom Remote Search app |
NEXT Connect to a standalone Splunk instance |
This documentation applies to the following versions of Splunk® Phantom Remote Search: 1.0.17
Feedback submitted, thanks!