How to install and configure the Splunk App for Dropbox for Business in an indexer and search head clustering environment?

[briangmadden]

I have a multi-node indexer cluster with a 3 node search head cluster and two load balanced Heavy forwarders in my Splunk environment. The security team has requested that we install & get the Splunk App for Dropbox for Business working. Does anybody know what the actual steps are in getting the app working in such an environment? Ideally, the connection to Dropbox will be initiated by HFs and sent to Indexers.

[briangmadden · Accepted solution]

Finally got this working in my environment. The lack of documentation is very frustrating.

1. Create Dropbox index on the Index Cluster

2. Install Dropbox App on Heavy Forwarder

3. Rename indexes.conf in default folder on HF

4. Add outputs.conf pointing to my IndexCluster in local folder of Dropbox App on HF.

5. Install Dropbox App on Search Head Cluster.

6. Change the event-type "dfb_activity" to include "index=your index_name" sourcetype=dfb:activity instead of calling the macro. This is required to get the dashboard working within the application.

[stephanefotso]

Hello! You must use the configuration bundle method. For more information read this first http://docs.splunk.com/Documentation/Splunk/6.3.3/Indexer/Managecommonconfigurations
ant then read this: http://docs.splunk.com/Documentation/Splunk/6.3.3/Indexer/Manageappdeployment

Thanks