All Apps and Add-ons

CrowdStrike Falcon Endpoint Add-on: Support Search Head Cluster?

wryanthomas
Contributor

Hi there. Thanks for this add-on. We need to run it on Splunk Cloud w/ Search Head Cluster (SHC). But we are being told the add-on is not SHC compatible.

Can you please make it SHC-compatible?

DenM
Explorer

Hello,

No mention about Search Head cluster support in the doc from Crowdstrike. If you have a test environment you can test it. But i'm sure it's working on search head cluster, i have many apps in production with no mention for shc and it works perfectly.
Try to push the app with your deployer to the shc member (be careful to remove the inputs.conf file on the Search heads)

Refer to: https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/PropagateSHCconfigurationchanges

This app is supported by crowdstrike regarding to Splunk Base, you can ask directly to: integrations(at)crowdstrike(dot)com

Hope it helps,

0 Karma

wryanthomas
Contributor

Thanks DenM. I appreciate the reply. We have a fully managed Splunk Cloud SHC -- we can't install such apps on our own. That is, the interface we have will indicate whether it is deemed SHC compatible or not. If not, we can't install it ourselves. And if we ask Splunk and vetting suggests it's not SHC compatible, they won't install it without remediation.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...