In distributed search, which components need to be installed on instances other than the search head?

SA-IndexCreation is required on all indexers. For non-clustered, distributed environments, copy SA-

IndexCreation to $SPLUNK_HOME/etc/apps/ on individual indexers.

Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Install/InstallDD

In distributed search, the components that need to be installed on instances other than the search

head are SA-IndexCreation and SA-ITSI-Licensechecker on indexers. SA-IndexCreation is an add-on

that creates the indexes required by ITSI, such as itsi_summary and itsi_tracked_alerts. SA-ITSI-

Licensechecker is an add-on that monitors the license usage of ITSI and generates alerts when the

license limit is exceeded or about to expire. These components need to be installed on indexers

because they handle the data ingestion and storage functions for ITSI. The other components, such

as ITSI app and SA-ITOA, need to be installed on the search head(s) because they handle the search

management and presentation functions for ITSI. Reference: Install IT Service Intelligence in a

distributed environment