All Apps and Add-ons

Can I use it without the app?

rdownie
Communicator

Can I use fireeye without the app? We created the sourcetype/index added a user account in splunk and configured the fireeye appliance using the XML POST string. Do we need anything else? Also, if we want to use a forwarder is that do-able?
Thanks,
-Bob

Tags (1)
0 Karma
1 Solution

rdownie
Communicator

Yes you can. Works like any other data coming in. Just forward data to Splunk using the mechanism provided by the fire eye. We had it forward it in XML and used kvmode=xml to auto extract, used field aliases to simplify/shorten the field names.

View solution in original post

0 Karma

rdownie
Communicator

Yes you can. Works like any other data coming in. Just forward data to Splunk using the mechanism provided by the fire eye. We had it forward it in XML and used kvmode=xml to auto extract, used field aliases to simplify/shorten the field names.

0 Karma

jbrodsky_splunk
Splunk Employee
Splunk Employee

I think you posted this three times, Bob - you might want to check that. But in general, splunk apps are entirely OPTIONAL for any given data source. There's no reason you can't bring the data from any datasource into "core Splunk" and then use Splunk to perform your regular searches/field extractions/event typing/reporrting/dashboarding. However, apps generally get you much more value in an "out of the box" fashion.

I doubt sincerely that you will be able to get a standard Splunk forwarder onto your appliance, nor that Fireeye would consider that a supported configuration.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...