Splunk Dev

Different behavior running Add-on in Search Head Cluster environment

annmarienorcros
Loves-to-Learn Everything

I am working on a Splunk Add-on that was developed on stand alone Splunk that I am now testing in a search head cluster environment. The Add-on uses a modular script that sends Splunk search data or notable event data to a 3rd party app when a saved search is matched.

Our Add-on ships 2 saved searches for users to use to verify that the add-on is configured properly with the 3rd party app.

On stand alone Splunk (with Splunk ES also installed) both of these saved searches are triggered when there is a failed Splunk server login that is logged in splunkd:

index=_internal sourcetype=splunkd ERROR UiAuth                                            (for Splunk without Splunk ES)

index=_internal sourcetype=splunkd ERROR UiAuth | `get_event_id`        (for Splunk ES)

In the SHC environment, when there is a failed login, we are only seeing one of the two rules triggered (it is not consistent which one is triggered).
Can anyone explain why only one rule would be triggered in SHC environment?
I’m trying to figure out if the SHC is not setup properly, if there is something the Add-on is not doing properly or if there is some other issue?

We are currently testing on Splunk 8.1.0 and Splunk ES 6.1.1, CIM 4.15.0.
Do you think upgrading Splunk to 8.2 would make any difference?

Thanks for any help!

AnnMarie

Labels (2)
0 Karma

annmarienorcros
Loves-to-Learn Everything

I installed the add-on to the search heads using the deployer that is running on a separate instance that is not part of the cluster.

0 Karma

codebuilder
SplunkTrust
SplunkTrust

How did you install the add-on? To use it on a SHC you would need to use a deployer to push it out, unlike on a standalone where you can install via the web UI.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...