All Apps and Add-ons

Installation Question

hainesa
Engager

Attempting to install/configure the Splunk Add-on for Cisco ASA. Based on the README file, it isn’t clear to me where we need to install this app for our environment.

http://apps.splunk.com/app/1620/

In a distributed environment where Search Head and Indexer are on separate servers and ASAs dumping logs to a remote syslog server (also separate). The syslog server has the Splunk Universal Forwarder installed and forwards log data to Splunk.

The README is clear in that we need to install on the Search Head. My question is do we also install the app on the syslog server, the indexer, or both?

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

This Add-on has components for search time (the search head) and index-time(the indexer and/or the forwarder) processing so basically there are parts of it that are required in both/all places.

Not knowing exactly how your deployment is set up, the short answer is... it can't hurt anything to install it on the search head, the indexer... and the forwarder.

Basically... the search head will take advantage of the search time field extractions, the tags, eventtypes, macros etc... the indexer will take advantage of any sourcetype assignments, and other transforms. Depending on how your deployment is set up, some of that might be happening on at the forwarder before it decides which indexer to send to (see the last bit of the readme for that) which means you want it on the forwarder.

There are some apps where each component is broken out further into TA or SA folders... in this case, it's all in one app.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Get Updates on the Splunk Community!

Get Schooled with Splunk Education: Explore Our Latest Courses

At Splunk Education, we’re dedicated to providing incredible learning experiences that cater to every skill ...

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...