All Apps and Add-ons

CrowdStrike Falcon Endpoint Add-on: Support Search Head Cluster?

wryanthomas
Contributor

Hi there. Thanks for this add-on. We need to run it on Splunk Cloud w/ Search Head Cluster (SHC). But we are being told the add-on is not SHC compatible.

Can you please make it SHC-compatible?

DenM
Explorer

Hello,

No mention about Search Head cluster support in the doc from Crowdstrike. If you have a test environment you can test it. But i'm sure it's working on search head cluster, i have many apps in production with no mention for shc and it works perfectly.
Try to push the app with your deployer to the shc member (be careful to remove the inputs.conf file on the Search heads)

Refer to: https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/PropagateSHCconfigurationchanges

This app is supported by crowdstrike regarding to Splunk Base, you can ask directly to: integrations(at)crowdstrike(dot)com

Hope it helps,

0 Karma

wryanthomas
Contributor

Thanks DenM. I appreciate the reply. We have a fully managed Splunk Cloud SHC -- we can't install such apps on our own. That is, the interface we have will indicate whether it is deemed SHC compatible or not. If not, we can't install it ourselves. And if we ask Splunk and vetting suggests it's not SHC compatible, they won't install it without remediation.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...