Skip to main content
Question

Since Cribl is doing all the hard work, I can remove the palo TA from the indexers?

  • March 11, 2025
  • 3 replies
  • 32 views
M

I configured the PALO pack and it's awesome. I have the data going out via HEC. Am I right to assume since Cribl is doing all the hard work, I can remove the palo TA from the indexers? I assume I'd still want it on the search heads

    3 replies

    K
    • Kevin Morris
    • Employee
    • March 11, 2025

    <@U027YPMUU8M&gt; you would still need the Add-on on the indexers since there are things that are still happening such as data models, etc...

    N
    • nick
    • Employee
    • March 11, 2025

    and since Cribl is cooking the data, that means Indexer has nothing to do.

    N
    • nick
    • Employee
    • March 11, 2025

    uh, no. SHs handle that. If you aren't doing index-time work, then yes, you can yank the TA.Only caveat to that I can think of is large lookups. Sometimes, search bundles get too large and having the lookups on indexers can help with that.

    Terms & ConditionsAccessibility statement