Issues While Launching Corelight App for Splunk on Splunk Search head

[pdafale_avantor]

Hello Team,

We have been using Corelight APP for Splunk to ingest Corelight IDS events to our distributed Splunk environment. This app is working absolutely fine on Indexer. 

We are unable to launch this app on Search head. Can you please assist us with the details to get the App working on Search Head?

Regards,

Prathamesh

[livehybrid]

Hi @pdafale_avantor 

Please could you confirm, is it the TA for Corelight or the Corelight App For Splunk that you have installed on your searchhead?  

The TA is what you would install on your indexing / HF tier hosts for any index-time parsing requirements and this app actually is specifically hidden from the UI with the following app.conf settings.

[ui]
is_visible = 0

 This is becasue the app is not intended to be used visually. Instead you would install the  Corelight App For Splunk on your searchead(s) which does contain a number of Corelight dashboards, lookups and even ca custom-command. Interestingly the TA also includes a lot of this content but is not a dedicated visible app - if you specifically want the dashboards then you will need to install Corelight App For Splunk on your searchead(s).

If you have actually installed this and you're not able to see it then please let u know and we can investigate further with you.

🌟 Did this answer help you? If so, please consider:

• Adding kudos to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[kiran_panchavat]

@pdafale_avantor 

An add-on handles data ingestion and parsing and must be installed on Indexers or Heavy Forwarders. An App includes the dashboards, visualizations, and search-time configurations that allow you to interact with the data., needs to be installed on Search Heads.

App: https://splunkbase.splunk.com/app/3884  - Install this app on the search head.
Add-on: https://splunkbase.splunk.com/app/3885  - This is the Indexer TA for the Corelight App.

Important: The TA for Corelight add-on is required on indexers, or index clusters. If your Corelight sensors send data directly to a heavy forwarder or a Splunk Cloud Platform receiver that is a heavy forwarder, the TA for Corelight is also required on those instances. The add-on is not required on search heads, or single-instance Splunk Enterprise environments.

I've installed the app in my test environment, and it includes several dashboards. Please refer to the image below for your reference. Once your data is onboarded into Splunk with the correct sourcetypes, these dashboards will automatically populate with your data