Upgradation of Splunk for Symantec App

[rahul2gupta]

Hi @gcusello ,

We've been asked to upgrade our existing Splunk version(7.1.3) to 8.1. So for that we are now upgrading our apps that are not compatible with the version 8.1.x.

I've started with the Symantec App. Its current version is 1.0.3 which is NOT supported by Splunk now and I seek your help to upgrade this app( I've downloaded its higher version ) but I am stuck as I don't know how to configure .

Regards,

Rahul Gupta

[gcusello]

Hi @rahul2gupta,

this is a very old app (2013) and it's supported on Splunk 4.3 and 5!

In addition, it works with Symantec Endpoint Protection 11 & 12, which version have you?

There are many other apps for Symanted Endpoint, why don't you see if one of these can work with your Symantec Endpoint Protection?

Anyway, if you want to use that app, you have to take one by one each dashboard and see if it receives the data or maybe you need different TAs, there isn't any script that requires python and this is helpful, but the problem is the data ingestion, in other words, see the existing TAs and see if you have to manually modify the dashboards to adapt them to the new data flows.

Ciao.

Giuseppe

[rahul2gupta]

Thanks @gcusello !

Seems like I've to go with this app only and need to manually modify the dashboards.

Regards,

Rahul

[gcusello]

Hi @rahul2gupta,

tell me if I can help you more, otherwise, please, accept my answer for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉