Distributed splunk and Fireeye_v3

[jgoddard]

I am a bit unclear as to how to get this app configured correctly in a distributed setup.

I hope to use the REST api and JSON for the format of the data, and my plan was to point the Fireeye to the REST api of a heavy forwarder, but the documentation is not very clear as to whether this is possible, and whether this setup requires the full app to be on my heavy forwarder (as it appears from looking at the app).

Also, is the Fireeye_v3 app compatible with search head clusters?

Thanks,
Jim

[TonyLeeVT]

Sorry Jim. This is not a FireEye App specific question. This is more of a Splunk question of what is possible with a HF and what is required of a HF to work with apps (any app). We only supply the app and the TA.

There are distributed environments running the app and I can say that typically the app is installed on the search head and the TA's are installed on the HF and other components that do not need the UI. Please reach out to Splunk support with this question. If you send us the answer, we are more than happy to put it in the documentation for future reference and other users.

If you don't get anywhere with Splunk Support, shoot me an email through the app and maybe we can both get on the phone with them.