All Apps and Add-ons

CrowdStrike Falcon Endpoint Add-on: Support Search Head Cluster?


Hi there. Thanks for this add-on. We need to run it on Splunk Cloud w/ Search Head Cluster (SHC). But we are being told the add-on is not SHC compatible.

Can you please make it SHC-compatible?



No mention about Search Head cluster support in the doc from Crowdstrike. If you have a test environment you can test it. But i'm sure it's working on search head cluster, i have many apps in production with no mention for shc and it works perfectly.
Try to push the app with your deployer to the shc member (be careful to remove the inputs.conf file on the Search heads)

Refer to:

This app is supported by crowdstrike regarding to Splunk Base, you can ask directly to: integrations(at)crowdstrike(dot)com

Hope it helps,

0 Karma


Thanks DenM. I appreciate the reply. We have a fully managed Splunk Cloud SHC -- we can't install such apps on our own. That is, the interface we have will indicate whether it is deemed SHC compatible or not. If not, we can't install it ourselves. And if we ask Splunk and vetting suggests it's not SHC compatible, they won't install it without remediation.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!