Distributed deployment installation and configuration overview

A distributed deployment for Splunk Stream includes the following components. For installation steps, see Install Splunk Stream in a distributed deployment

Component Usage
search heads splunk_app_stream and Splunk_TA_stream_wire_data are required on search heads.
indexers Splunk_TA_stream_wire_data is required on all indexers for searching and parsing.
universal forwarders Splunk_TA_stream is required on universal forwarders at the location(s) where you want to capture network data. For more information, see Network collection architectures in this manual.
heavy forwarders
  • Install Splunk_TA_stream where you want to capture network data.
  • Install Splunk_TA_stream_wire_data on your heavy forwarder wherever that index performs pipeline processing.
deployment server Use the Splunk deployment server to distribute Splunk_TA_stream to universal forwarders across a distributed deployment. When you upgrade to a new version of Splunk Stream, if the deployment server detects a new version of Splunk_TA_stream then all universal forwarders subscribed as deployment clients will pull and install the new version. For more information, see