topic Re: SEP Dashboards? in All Apps and Add-ons

SEP Dashboards?

jastle123456 — Wed, 09 Mar 2016 19:29:12 GMT

Hello,

I have Splunk 6.3.1 running on a single Linux instance. I have installed the Splunk Add-on for Symantec Endpoint Protection V2.1.0 , setup my SEP 12 server to dump logs, forward logs from sep server to Splunk server to a new "symantec" index. I am seeing all of my logs and parsing is looking great.

Is there something special I need to do to activate the Dashboards? I dont see them anywhere.

Thanks

Re: SEP Dashboards?

rpille_splunk — Wed, 09 Mar 2016 22:59:13 GMT

Hi jastle123456. This add-on has pre-built panels, but you have to put them into a dashboard yourself. Here are the steps to do that: http://docs.splunk.com/Documentation/AddOns/latest/Overview/Prebuiltpanels

Hope that helps!

Re: SEP Dashboards?

jastle123456 — Thu, 10 Mar 2016 14:32:39 GMT

Perfect! Thanks.

Re: SEP Dashboards?

sphadnis — Wed, 06 Jul 2016 01:40:06 GMT

I have Splunk 6.1 - will the prebuilt panels work on this version too? Please let me know - Thanks!

Re: SEP Dashboards?

mreynov_splunk — Wed, 06 Jul 2016 03:13:07 GMT

Should not be a problem.

Re: SEP Dashboards?

sphadnis — Wed, 06 Jul 2016 22:02:14 GMT

Thanks. I just installed the TA on my Search head, and I dont see any prebuilt panels. I am using this link http://docs.splunk.com/Documentation/AddOns/latest/Overview/Prebuiltpanels and when I try to set the app context to "Splunk Add-on for Symantec Endpoint Protection" I dont even see it in the list. Also, when I try to add any panels on a new dashboard, I do not see anything with SEP or Symantec. What am I doing wrong? (I installed the TA using the tgz on the "install app from the file" option. Please let me know - thanks!

Re: SEP Dashboards?

rpille_splunk — Thu, 07 Jul 2016 15:33:28 GMT

Prebuilt panels were introduced in Splunk platform version 6.2, so you would need to upgrade before attempting to use this feature.