All Apps and Add-ons

Issues While Launching Corelight App for Splunk on Splunk Search head

pdafale_avantor
Engager

Hello Team,

We have been using Corelight APP for Splunk to ingest Corelight IDS events to our distributed Splunk environment. This app is working absolutely fine on Indexer. 

We are unable to launch this app on Search head. Can you please assist us with the details to get the App working on Search Head?

 

Regards,

Prathamesh

Labels (1)
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @pdafale_avantor 

Please could you confirm, is it the TA for Corelight or the Corelight App For Splunk that you have installed on your searchhead?  

The TA is what you would install on your indexing / HF tier hosts for any index-time parsing requirements and this app actually is specifically hidden from the UI with the following app.conf settings.

[ui]
is_visible = 0

 This is becasue the app is not intended to be used visually. Instead you would install the  Corelight App For Splunk on your searchead(s) which does contain a number of Corelight dashboards, lookups and even ca custom-command. Interestingly the TA also includes a lot of this content but is not a dedicated visible app - if you specifically want the dashboards then you will need to install Corelight App For Splunk on your searchead(s).

If you have actually installed this and you're not able to see it then please let u know and we can investigate further with you.

🌟 Did this answer help you? If so, please consider:

  • Adding kudos to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

 

0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@pdafale_avantor 

An add-on handles data ingestion and parsing and must be installed on Indexers or Heavy Forwarders. An App includes the dashboards, visualizations, and search-time configurations that allow you to interact with the data., needs to be installed on Search Heads.
 

App: https://splunkbase.splunk.com/app/3884  - Install this app on the search head.
Add-on: https://splunkbase.splunk.com/app/3885  - This is the Indexer TA for the Corelight App.

Important: The TA for Corelight add-on is required on indexers, or index clusters. If your Corelight sensors send data directly to a heavy forwarder or a Splunk Cloud Platform receiver that is a heavy forwarder, the TA for Corelight is also required on those instances. The add-on is not required on search heads, or single-instance Splunk Enterprise environments.

I've installed the app in my test environment, and it includes several dashboards. Please refer to the image below for your reference. Once your data is onboarded into Splunk with the correct sourcetypes, these dashboards will automatically populate with your data

kiran_panchavat_0-1743779184346.png

 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...