In distributed search, which components need to be installed on instances other than the search head?

In distributed search, which components need to be installed on instances other than the search head?
A . SA-IndexCreation and SA-ITSI-Licensechecker on indexers.
B . SA-IndexCreation and SA-ITOA on indexers; SA-ITSI-Licensechecker and SA-UserAccess on the license master.
C . SA-IndexCreation on idexers; SA-ITSI-Licensechecker and SA-UserAccess on the license master.
D . SA-ITSI-Licensechecker on indexers.

View Answer

Answer: A

Explanation:

SA-IndexCreation is required on all indexers. For non-clustered, distributed environments, copy SA-IndexCreation to $SPLUNK_HOME/etc/apps/ on individual indexers.

Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Install/InstallDD

In distributed search, the components that need to be installed on instances other than the search head are SA-IndexCreation and SA-ITSI-Licensechecker on indexers. SA-IndexCreation is an add-on that creates the indexes required by ITSI, such as itsi_summary and itsi_tracked_alerts. SA-ITSI-Licensechecker is an add-on that monitors the license usage of ITSI and generates alerts when the license limit is exceeded or about to expire. These components need to be installed on indexers because they handle the data ingestion and storage functions for ITSI. The other components, such

as ITSI app and SA-ITOA, need to be installed on the search head(s) because they handle the search management and presentation functions for ITSI.

Reference: Install IT Service Intelligence in a distributed environment