All Apps and Add-ons

How to install the Tripwire Enterprise App for Splunk Enterprise on a Search Head?

scc00
Contributor

Hi, I'd like to install the Tripwire Enterprise app on one of my Search Heads. I do not want the logs to be stored locally since it is a search head. The logs should be pushed to my indexers, preferably load balanced. So my question is this, given that the app will be installed on a search head, would it be best to install a universal forwarder on the tripwire console server, then configure the outputs.conf files to send to my indexers? Given the question i've just asked, can I also configure the Tripwire Data Directory to point to the essentially load balanced indexers when I setup the app? Or is there a better way to accomplish all of this? The installation instruction does not mention any of this.

0 Karma

JimWachhaus
Path Finder

Originally the app was intended to be installed on a Search Head with the logs going to the search head.

An alternative is to use a heavy forwarder.

The universal forwarder method described may not work.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!