topic Re: Splunk enterprise security add-on nomenclature in Splunk Enterprise Security

Splunk enterprise security add-on nomenclature

RiccardoV — Mon, 28 Sep 2020 20:02:43 GMT

Hi guys,
I am developing an addon for Splunk ES and I'm a little bit confused about the name I have to give to the folder of that addon.

It seems (as here) that I have to name the folder as TA-APPNAME, but under the Splunk ES apps folder I have some other addons named as Splunk_TA_APPNAME (Splunk_TA_windows, Splunk_TA_mcafee..).
Which is the correct one?

And another question: I see that I have many other kind of pattern in my apps directory, as SA-, DA-ESS-. What are they?

thanks!

Re: Splunk enterprise security add-on nomenclature

esix_splunk — Mon, 28 Sep 2020 20:02:46 GMT

Splunk supported TA's are taking on the name Splunk_TA_appname, and the SA / DA names are based on the functionality of the ES app as described in the documentation at :

http://docs.splunk.com/Documentation/ES/latest/Install/ESArchitecture

You can name your's both TA-appname or Splunk_TA_appname and it will get imported.

Re: Splunk enterprise security add-on nomenclature

RiccardoV — Mon, 25 May 2015 09:22:58 GMT

thanks a lot for your fast answer. What does it mean "splunk supported TA"? It means that if I'm developing an addon by myself without Splunk "collaboration" I should name it as TA-*, right?

Re: Splunk enterprise security add-on nomenclature

esix_splunk — Mon, 28 Sep 2020 20:04:26 GMT

Any app with the TA-appname or Splunk_TA_appname is automatically imported into ES. Additionally, Splunk supported means the TAs released and officially supported via support contracts with Splunk.

Re: Splunk enterprise security add-on nomenclature

RiccardoV — Mon, 25 May 2015 09:27:31 GMT

Thanks a lot 🙂

Re: Splunk enterprise security add-on nomenclature

miteshvohra — Mon, 25 May 2015 10:33:51 GMT

Splunk Docs link for "Naming conventions for apps and add-ons on Splunkbase" : http://docs.splunk.com/Documentation/Splunkbase/latest/Splunkbase/Namingguidelines

Mitesh.

Re: Splunk enterprise security add-on nomenclature

RiccardoV — Tue, 26 May 2015 07:35:52 GMT

thanks but it doesn't answer to my question 🙂 I was asking about the name of the folder, not the app/addon name