All Apps and Add-ons
Highlighted

How can I install the CEF Extraction Add-on for Splunk Enterprise?

New Member

I'm not using the Distributed Deployment, so I can't understand the guide in the documentation for this add-on. I have installed Splunk Enterprise and want it to index and search CEF files. Anyone can help? Thank you.

0 Karma
Highlighted

Re: How can I install the CEF Extraction Add-on for Splunk Enterprise?

Path Finder

All you need to do is install the add-on and make sure your CEF data's sourcetype is "cefevents"

View solution in original post

Highlighted

Re: How can I install the CEF Extraction Add-on for Splunk Enterprise?

Explorer

Hi...I wanted to followup on this question, if I may, as we are looking at installing this add-on. We are using Distributed deployment. So, does this addon get installed on the Forwarder? If so, the Forwarder client is on Linux. So, being a *nix novice, would we just run the tar command?

0 Karma
Highlighted

Re: How can I install the CEF Extraction Add-on for Splunk Enterprise?

Builder

@tmaltizo
Hopefully you figured it out or asked in a new thread. For installing to your forwarder in a distributed env, hopefully you have a deployment server and would unzip the tgz into the deployment-apps folder there, then assign it to your forwarder via serverclass.conf entry.

0 Karma