In a distributed Splunk deployment, ensure that you install VirusTotal App only on search heads. This app is safe to install in large Splunk clusters as it does not affect indexers. For detailed installation instructions, refer to the guide on installing an add-on in a distributed Splunk Enterprise deployment available in the Splunk Add-ons menu.