All Apps and Add-ons

Which server to do data collection for Check Point OPSEC LEA app?

stwong
Communicator

Hi, we're going to deploy Check Point OPSEC LEA app in our clustered Splunk environment. It requires opening tcp port 18184 and 18210 in firewall from Splunk to Checkpoint log/management server, which not sure which Splunk server to do data collection.

We're using indexer cluster. Shall we do data collection on one of the indexers ?

Besides, although we hope to have resilience in case of the data collection server fails, can only use one data collection server to avoid duplicated data. Is that correct?

Thanks a lot.
Regards
/ST Wong

0 Karma
1 Solution

aakwah
Builder

Hello,
OPSEC LEA app consist of 2 parts, data collection part and knowledge objects part.
Data collection part is a scripted input, that contains wrapper python scripts that invokes the loggrabber binary that pulls logs from Checkpoint management server, then you can forward logs to any destination which is indexers in case of Splunk cluster.

So the best practices is to install the app on heavy forwarders (as python is required) for data collection.
And it should be installed on search heads to have knowledge objects (lookups, aliases, field extraction)

Have a look to this doc for more details:
http://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Install

Regards

View solution in original post

0 Karma

stwong
Communicator

Hi all,

Thanks a lot for your advice.

Regards

0 Karma

aakwah
Builder

It is my pleasure ..

0 Karma

aakwah
Builder

Hello,
OPSEC LEA app consist of 2 parts, data collection part and knowledge objects part.
Data collection part is a scripted input, that contains wrapper python scripts that invokes the loggrabber binary that pulls logs from Checkpoint management server, then you can forward logs to any destination which is indexers in case of Splunk cluster.

So the best practices is to install the app on heavy forwarders (as python is required) for data collection.
And it should be installed on search heads to have knowledge objects (lookups, aliases, field extraction)

Have a look to this doc for more details:
http://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Install

Regards

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi Wong,

Please install the Splunk Add-on for OPSEC LEA to collect data, which then feeds into the app. Follow the installation instructions here:

http://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Install

Hope this helps. Thanks!
Hunter

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...