Hi Support,
We are trying to deploy Varonis App and Varonis Technology Add-On( AKA Varonis TA) on Splunk.
According to VARONIS DATALERT APP AND TECHNOLOGY ADD-ON FOR Splunk User guide.
We install Varonis App on one of Splunk search head, and Varonis TA on Splunk heave forwarder.
However, we can not see any information on Splunk.
So, we contact Varonis Support and make sure the Varonis DatAlert is find to send syslog to Splunk, and Varonis Support replayed that Varonis only certified with Splunk single-server environment.
The environment we using now is a cluster-server environment. We had search heads, indexer, forwarder and heavy forwarder.
So, did Splunk Support have any experience about Varonis App and Varonis TA deploy on Splunk cluster-server environment?
Or any other suggestion for us, please?
Thank you.
