Can the Splunk Add-on for Bro IDS be used with Splunk Light?

[terencegoggin]

After spending what feels like too much time on this project, I am getting the strong idea that Splunk Light simply doesn't support the Bro add-on. (Yes, I know that the download page specifies it's only for the Enterprise edition, but the installation instructions cover any/all versions.)

1. Could someone please officially confirm this?
2. I like Splunk and know it because I use it at work. I just want to run Splunk against my home network data. Why is this so difficult?
3. I'd gladly pay for the privilege - really! Splunk is a great product, and you deserve to be rewarded. Why isn't there a reasonably priced home option?

Thank you,

Terence

[rpille_splunk]

Hi Terence,

Excellent question. Splunk Light currently supports only a limited number of add-ons, which you can browse in their in-product add-on browser. The list of add-ons that are supported here may change in future releases, which is why individual add-on documents do not specify whether or not it is supported on Splunk Light (or Splunk Cloud, where the same situation applies.) If you have a strong need for this add-on in Splunk Light, I encourage you to file a support case and further explain your use case.

Thanks!

~ Robin

[terencegoggin]

Robin,

With respect, it feels like you haven't really addressed the meat of my three questions.

1. I'm guessing that you mean to confirm that the Bro plugin isn't supported in Splunk Light. Frankly, this is not only disappointing, but frustrating. I've (apparently) wasted a lot of time that could have been better invested.
2. Ok, perhaps you have addressed this one; I apologize. You say that the list of add-ons changes frequently, and so each one's documentation is a bit lacking. Fair enough, but you guys can do better. Again, your product is wonderful, and your docs are usually right there with it.
3. This definitely feels wholly unaddressed. Why can't I just pay you good people something like $200/year for the privilege of running Splunk on my home network? I'm nowhere near the daily limits, but I /want/ to be a paid user.

Thanks, and thanks for sticking with me on this quest.

[rpille_splunk]

Thanks, Terence, for your feedback. We are working on ways to help clarify up front which components are supported in Splunk Light and Splunk Cloud, so I hope that your frustration will not be repeated.

We'll get in touch with you separately to resolve this with you. Thanks again for raising these questions!