Can I use it without the app?

[rdownie]

Can I use fireeye without the app? We created the sourcetype/index added a user account in splunk and configured the fireeye appliance using the XML POST string. Do we need anything else? Also, if we want to use a forwarder is that do-able?
Thanks,
-Bob

[rdownie · Accepted solution]

Yes you can. Works like any other data coming in. Just forward data to Splunk using the mechanism provided by the fire eye. We had it forward it in XML and used kvmode=xml to auto extract, used field aliases to simplify/shorten the field names.

[jbrodsky_splunk]

I think you posted this three times, Bob - you might want to check that. But in general, splunk apps are entirely OPTIONAL for any given data source. There's no reason you can't bring the data from any datasource into "core Splunk" and then use Splunk to perform your regular searches/field extractions/event typing/reporrting/dashboarding. However, apps generally get you much more value in an "out of the box" fashion.

I doubt sincerely that you will be able to get a standard Splunk forwarder onto your appliance, nor that Fireeye would consider that a supported configuration.