topic Re: Upgradation of Splunk for Symantec App in Getting Data In

Upgradation of Splunk for Symantec App

rahul2gupta — Sun, 25 Jul 2021 12:33:48 GMT

We've been asked to upgrade our existing Splunk version(7.1.3) to 8.1. So for that we are now upgrading our apps that are not compatible with the version 8.1.x.

I've started with the Symantec App. Its current version is 1.0.3 which is NOT supported by Splunk now and I seek your help to upgrade this app( I've downloaded its higher version ) but I am stuck as I don't know how to configure .

Regards,

Rahul Gupta

Re: Upgradation of Splunk for Symantec App

gcusello — Sun, 25 Jul 2021 14:30:19 GMT

Hi @rahul2gupta,

this is a very old app (2013) and it's supported on Splunk 4.3 and 5!

In addition, it works with Symantec Endpoint Protection 11 & 12, which version have you?

There are many other apps for Symanted Endpoint, why don't you see if one of these can work with your Symantec Endpoint Protection?

Anyway, if you want to use that app, you have to take one by one each dashboard and see if it receives the data or maybe you need different TAs, there isn't any script that requires python and this is helpful, but the problem is the data ingestion, in other words, see the existing TAs and see if you have to manually modify the dashboards to adapt them to the new data flows.

Ciao.

Giuseppe

Re: Upgradation of Splunk for Symantec App

rahul2gupta — Thu, 29 Jul 2021 12:20:47 GMT

Thanks @gcusello !

Seems like I've to go with this app only and need to manually modify the dashboards.

Regards,

Rahul

Re: Upgradation of Splunk for Symantec App

gcusello — Thu, 29 Jul 2021 12:27:35 GMT

Hi @rahul2gupta,

tell me if I can help you more, otherwise, please, accept my answer for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉