topic Re: Tenable App for Splunk use with Heavy Forwarder in All Apps and Add-ons

Tenable App for Splunk use with Heavy Forwarder

gheller — Thu, 15 May 2025 13:27:35 GMT

I am trying to set up the Tenable App for Splunk and the documentation is a bit vague about whether it requires a Heavy Forwarder to operate. I found an old post from 2017 that mentioned it did, but it was referencing older versions of Nessus than what is used in my environment. Does anyone know if a heavy forwarder is still required for the Tenable App for Splunk?

Re: Tenable App for Splunk use with Heavy Forwarder

kiran_panchavat — Thu, 15 May 2025 14:09:36 GMT

@gheller Inputs must be configured to run from the Heavy Forwarder. The Search Head is used for dashboards and adaptive response actions, but it relies on data collected and forwarded by the Heavy Forwarder.

It's important to enable the KV Store on the Heavy Forwarder to support the add-on's functionality

Tenable and Splunk Integration Guide

The Tenable Add-on has specific purposes for each Splunk component.

Components

Install the add-on on both the Heavy Forwarder and the Search Head but create data inputs only on the heavy forwarder. https://splunkbase.splunk.com/app/4060

Install the app exclusively on the Search Head. https://splunkbase.splunk.com/app/4061

Re: Tenable App for Splunk use with Heavy Forwarder

PickleRick — Thu, 15 May 2025 14:45:53 GMT

Depends on what you means by "require HF". Modular inputs must be run on a "full" Splunk Enterprise instance. So in this meaning - it requires HF because it won't run on UF. Technically you can run the modular input on an All-in-one instance without spinning up a separate HF. While you could run it also directly on an indexer or SH, it's not a recommended architecture - those roles are best left alone with what they do.

Re: Tenable App for Splunk use with Heavy Forwarder

livehybrid — Thu, 15 May 2025 15:00:53 GMT

Hi @gheller

The latest docs are at https://docs.tenable.com/integrations/Splunk/Content/Welcome.htm which they have recently updated, there is a great diagram to show where things should be installed:

In short, the Tenable Add-On for Splunk should be installed on your SH and HF (with inputs created on HF, or pushed out via your deployment server to HF if appropriate) and then install the Tenable App for Splunk on just the SH).

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification
Your feedback encourages the volunteers in this community to continue contributing