When deploying ITSI on a distributed Splunk installation, which component must be installed on the search head(s)?

When deploying ITSI on a distributed Splunk installation, which component must be installed on the search head(s)?
A . SA-ITOA
B . ITSI app
C . All ITSI components
D . SA-ITSI-Licensechecker

View Answer

Answer: B

Explanation:

Install SA-ITSI-Licensechecker and SA-UserAccess on any license master in a distributed or search head cluster environment. If a search head in your environment is also a license master, the license master components are installed when you install ITSI on the search heads.

Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Install/InstallDD

When deploying ITSI on a distributed Splunk installation, the component that must be installed on the search head(s) is the ITSI app. The ITSI app contains the main features and functionality of ITSI, such as service creation and management, KPI configuration, glass table creation and editing, episode review, deep dives, and so on. The ITSI app also contains some add-ons that provide additional functionality, such as SA-ITOA (IT Operations Analytics), SA-UserAccess (User Access Management), and SA-Utils (Utility Functions). The ITSI app must be installed on the search head(s) because it handles the search management and presentation functions for ITSI.

Reference: Install IT Service Intelligence in a distributed environment