All Apps and Add-ons

Tenable Add-on Configuration

dellytaniasetia
Explorer

Hello,

I have the following questions which not found in the documentation:
1. Any firewall rules to be open between SC and Splunk Heavy Forwarder?
2. Any indexes to be created at the indexers? If yes, what are the steps to create the indexes at my 2 indexers (they are non-clustered).

Any advice is appreciated.

Cheers

0 Karma

adamsaul
Communicator

Delly,

Adding the app to the indexers will then allow you to configure the data inputs. From there, you will choose which index the data goes to. I've included some screenshots of what you should see on your indexers after the add-on is added.
alt text

alt text

0 Karma

adamsaul
Communicator
  1. The queries to SC should be done via REST, either HTTP(TCP:80) or HTTPS(TCP:443)

  2. Indexes will be needed to be created. You can expedite this process by installing the add-on to your Indexers or creating a Search Head bundle and deploying it as such to your Indexers.
    http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/Updatepeerconfigurations

0 Karma

dellytaniasetia
Explorer

Hi,

For item number 2, are you referring to following steps:
To install an add-on to an indexer:
1. Download the add-on from Splunkbase, then unpack the .tgz package.
2. Place the resulting Splunk_TA_ folder in the $SPLUNK_HOME/etc/apps directory on your indexer.
3. Restart the indexer.

Have you performed this? What would be the name of the default indexes created?

Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...