Copy SA-IndexCreation to $SPLUNK_HOME/etc/apps/ on all individual indexers in your environment.

Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Install/InstallSHC

A is the correct answer because when installing ITSI to support a distributed search architecture, you

need to copy SA-IndexCreation to all indexers. SA-IndexCreation is an app that contains the

definitions of the ITSI indexes, such as itsi_summary, itsi_tracked_alerts, itsi_grouped_alerts, etc. You

need to copy this app to all indexers to ensure that they can store and search the ITSI data. B is not a

correct answer because you do not need to copy SA-IndexCreation to the etc/apps directory on the

index cluster master node. The index cluster master node does not store or search data, it only

manages the replication and availability of data across the index cluster peers. C is not a correct

answer because you do not need to extract the installer package into etc/apps directory of the cluster

deployer node. The cluster deployer node is used to distribute apps and configuration updates to the

search head cluster members. You need to extract the installer package into etc/shcluster/apps

directory of the cluster deployer node instead. D is not a correct answer because you do not need to

extract the ITSI app package into etc/apps directory of search head. You need to extract the ITSI app

package into etc/shcluster/apps directory of the cluster deployer node and use the deployer to push

the app to all search head cluster members. Reference: [Install Splunk IT Service Intelligence on a

search head cluster], [Install Splunk IT Service Intelligence on an indexer cluster]