topic Re: Will the Splunk for FireEye app run on Splunk 5.0? in All Apps and Add-ons

Will the Splunk for FireEye app run on Splunk 5.0?

joshua_hart — Tue, 18 Jun 2013 20:01:30 GMT

The documentation states the app is for 4.3.x, but is that the minimum version or the ONLY version supported?

I ask because I've got it installed on a 5.0.3 search head and FE is sending XML logs via HTTP, but I think the transforms aren't working properly. Fields aren't being delimited appropriately and some fields contain data from one or more fields.

Please advise, thanks!

-Josh

Re: Will the Splunk for FireEye app run on Splunk 5.0?

cpeteman — Tue, 18 Jun 2013 20:57:49 GMT

The most recent version seems to support version 5.0.3 http://splunk-base.splunk.com/apps/22354/fireeye. I've not run into any issues

Re: Will the Splunk for FireEye app run on Splunk 5.0?

cpeteman — Fri, 28 Jun 2013 18:28:09 GMT

The FireEye app claims to support the following versions: 4.3, 4.2, 4.1, 4.x, 5.x

Re: Will the Splunk for FireEye app run on Splunk 5.0?

BenjaminWyatt — Thu, 18 Jul 2013 18:39:02 GMT

The justification given for 4.3.x compatibility is that the app relies heavily on HTML 5 dashboards (which were added to Splunk in v4.3). From this I would assume the app is 5.0.x compatible unless it is specifically stated otherwise.

Field delimiters not working properly doesn't sound like an issue that would be caused by version incompatibility, although you might need to do some tinkering with props.conf and transforms.conf to make sure everything is coming across properly.