We have updated our Terms of Service, Code of Conduct, and Addendum.

Since Cribl is doing all the hard work, I can remove the palo TA from the indexers?

Mugdha Khandekar
Mugdha Khandekar Posts: 5 ✭
in General Discussions

I configured the PALO pack and it's awesome. I have the data going out via HEC. Am I right to assume since Cribl is doing all the hard work, I can remove the palo TA from the indexers? I assume I'd still want it on the search heads

Answers

  • Kevin Morris
    Kevin Morris Posts: 19 ✭

    <@U027YPMUU8M&gt; you would still need the Add-on on the indexers since there are things that are still happening such as data models, etc...

  • nick
    nick Posts: 4 mod

    uh, no. SHs handle that. If you aren't doing index-time work, then yes, you can yank the TA. Only caveat to that I can think of is large lookups. Sometimes, search bundles get too large and having the lookups on indexers can help with that.

  • nick
    nick Posts: 4 mod

    and since Cribl is cooking the data, that means Indexer has nothing to do.

Categories