Illumio App for Splunk Components
The Illumio App for Splunk comprises two parts:
Illumio Technology Add-On for Splunk (TA-Illumio)
Illumio App for Splunk
The Illumio Technology Add-On for Splunk and the Illumio App for Splunk are typically deployed together in the search head. TA-Illumio receives and transforms data, and enriches events with CIM fields. TA-Illumio can also be deployed at the indexer or forwarder. The Illumio App for Splunk uses the data enriched by TA-Illumio to display informational dashboards.