All Apps and Add-ons

How to install the Tripwire Enterprise App for Splunk Enterprise on a Search Head?

scc00
Contributor

Hi, I'd like to install the Tripwire Enterprise app on one of my Search Heads. I do not want the logs to be stored locally since it is a search head. The logs should be pushed to my indexers, preferably load balanced. So my question is this, given that the app will be installed on a search head, would it be best to install a universal forwarder on the tripwire console server, then configure the outputs.conf files to send to my indexers? Given the question i've just asked, can I also configure the Tripwire Data Directory to point to the essentially load balanced indexers when I setup the app? Or is there a better way to accomplish all of this? The installation instruction does not mention any of this.

0 Karma

JimWachhaus
Path Finder

Originally the app was intended to be installed on a Search Head with the logs going to the search head.

An alternative is to use a heavy forwarder.

The universal forwarder method described may not work.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.