The Tenable Add-on has specific purposes for each Splunk component. The available components are in the following list:
The Heavy Forwarder collects and forwards data for all events.
Note: Configure inputs to run from the heavy forwarder.
Note: Enable the key value store (KV) on the heavy forwarder.
The Indexer ensures Tenable data is properly indexed.
Note: Use a default index or create and set a custom index. This is required.
The Search Head allows full functionality of the Tenable Add-on adaptive response actions.
Note: Configure the Search Head with the same configuration details you have on the Heavy Forwarder for the adaptive response actions to work correctly.
Note: If you install the Tenable App for Splunk on the search head, you must also install the Tenable Add-on.