Will the Optiv Threat Intel app work in our (possibly unusual) Splunk deployment?

[amcquay]

We have a redundant pair of Splunk indexers/search heads that are digesting syslog data from our management network (read: no forwarders). I've installed the Optiv Threat Intel app but all panels simply display "no results found". The troubleshooting page displays "search did not return any events" as well.

I assume the app depends on the TA Threats app running on a separate forwarder in order to work properly?

[kchamplin_splun]

According to their documentation for the app - it looks like you need to install the optiv_TA_threat onto a heavy forwarder. So I think you're right.
https://splunkbase.splunk.com/app/2837/#/details

As of version 3.20, the app has split into two: optiv_threat_intel (this app) and optiv_TA_threat.
The optiv_threat_intel app continues to be installed on search heads. the optiv_TA_threat app
is to be installed on a single heavy forwarder in the environment only.

Install matrix:

Splunk role: App to install
Indexer: none*
Search head: optiv_threat_intel
Heavy forwarder: optiv_TA_threat

*create an "optiv" index on each indexer

[derekarnold]

Agreed. It looked like from OP's post maybe a heavy forwarder isn't in the environment. If you just have indexers and search heads, I'd put optiv_TA_threat on a single search head. Also, don't forget to create an optiv index if you haven't already. Read the readme.pdf carefully for more details.

[amcquay]

Correct, there is no heavy forwarder in the environment. In fact the indexer and search head are on the same device (configured before I got involved, I'm working to change our Splunk architecture as we speak).

I created an optiv index and installed the TA_threat app on the server as well, and after ~36 hours the splash page is now populated. Thanks for the input.