How do I install the Splunk Security Essentials app?

[johannterc]

Hello. Is there any documentation on how to properly install and configure the Security Essentials app? My setup is on CentOS and consists of a HF, IDX, SH, DS, and some universal forwarders. No clustering or load balancing.

[lfedak_splunk]

Hey @johannterc, if @smoir solved your problem please close the question by accepting the answer. Happy splunking! 🙂

[smoir_splunk · Accepted solution]

The app entry on Splunkbase includes installation guidance. It's safe to install on a distributed environment, and yours sounds fairly simple. See https://splunkbase.splunk.com/app/3435/#/details

[johannterc]

Thanks for the link I am reading over it now. To be clear, I log into my Search Head and untar the file into $SPLUNK_HOME$/etc/apps then restart the splunk service on my SH to make the application available correct?

Also, how do I make sure that the demo data does not replicate to my indexer?

[smoir_splunk]

It's set to not replicate by default, so nothing! Correct to all of the above.

[johannterc]

Thank you smoir! Marking your answer as correct now.