Has anyone installed the Corelight App (and TA) onto a clustered Splunk setup

[robnewman666]

I am trying to setup the Corelight App for Zeek data on a clustered Splunk setup, but it seems the TA doesn't want to work along with the App.  The App is required to be installed onto the Search Head cluster and the TA is to be on the Indexers, as per the guidelines from Corelight. I am wondering if the install isn't suited to a clustered Splunk setup.

I am also having error codes for a Windows TA - but im not sure if this relates to this issue here.

[lznger88ncc]

Hi, I am also having issues with the TA. Did you find a resolution to your issue?

[robnewman666]

As I recall, I think I made up my own TA to deal with the logs and also used some of the props.conf configs from the app which worked ok in the end for what I wanted it to do.