topic Can I install Extreme Search without Splunk Enterprise Security? in Splunk Enterprise Security

Can I install Extreme Search without Splunk Enterprise Security?

noybin — Mon, 14 Nov 2016 18:01:05 GMT

Can I install and use Extreme Search without Enterprise Seurity?

If yes, where should be installed (Search Head, Indexers)?

Any recommendations to consider?

Thank you very much.

Re: Can I install Extreme Search without Splunk Enterprise Security?

gjanders — Tue, 15 Nov 2016 06:37:04 GMT

As per the Extreme Search Visualisation page

It is not necessary to use the XSV app
or the Splunk App for Enterprise
Security to use Extreme Search. Since
Extreme Search is implemented as a set
of extensions to Splunk's search
language, it is available to any
Splunk app.

Just install the application on your search head,

Re: Can I install Extreme Search without Splunk Enterprise Security?

noybin — Wed, 16 Nov 2016 19:05:11 GMT

Thank you!

Re: Can I install Extreme Search without Splunk Enterprise Security?

ChrisG — Wed, 16 Nov 2016 20:45:09 GMT

That is just the visualization support. Extreme Search itself is no longer available as a separate app.

Re: Can I install Extreme Search without Splunk Enterprise Security?

noybin — Wed, 16 Nov 2016 20:47:42 GMT

So how can I use Extreme search then?

Re: Can I install Extreme Search without Splunk Enterprise Security?

ChrisG — Wed, 16 Nov 2016 20:57:00 GMT

It is part of Splunk Enterprise Security now, as you mentioned. So I guess the answer to your question is really "no, you can't use extreme search without Enterprise Security." 😕

Re: Can I install Extreme Search without Splunk Enterprise Security?

noybin — Wed, 16 Nov 2016 21:03:50 GMT

So What about the comment from the Extreme Search Visualization app that says:
"It is not necessary to use the XSV app or the Splunk App for Enterprise Security to use Extreme Search. Since Extreme Search is implemented as a set of extensions to Splunk's search language, it is available to any Splunk app."?

Re: Can I install Extreme Search without Splunk Enterprise Security?

ChrisG — Wed, 16 Nov 2016 21:07:54 GMT

I think that comment is outdated? It used to be true and it no longer is. Scianta's web site says "Extreme Search for Splunk is now owned and supported by Splunk Inc. It currently ships as part of the Splunk App for Enterprise Security."

Re: Can I install Extreme Search without Splunk Enterprise Security?

gjanders — Wed, 16 Nov 2016 21:13:48 GMT

The application still has python files and the various commands such as xsvcreateconcept so I thought it would work. I have not tested it yet though...

Re: Can I install Extreme Search without Splunk Enterprise Security?

jdeer0618 — Fri, 09 Dec 2016 20:04:58 GMT

Can't hurt to ask your sales rep or SE if you have one. They might be able to hook you up with Extreme Search as a standalone app.

Re: Can I install Extreme Search without Splunk Enterprise Security?

starcher — Mon, 12 Dec 2016 00:03:23 GMT

If you are an ES customer or can get your rep to provide XS you can install it. There is no actual dependance from an install standpoint on ES. Many ES customers use it on other search heads once they have it via their ES license.