Installation

How to deploy fortimail add-ons in splunk enterprise distributed env?

pacifikn
Communicator

Greetings!

how to deploy fortimail add-ons in splunk enterprise distributed environment?

 

As per now ,I was already downloaded the apps and uploaded in splunk search head , what next to do?

-In my env. I have 7servers( 1 SH, 1 splunk management node, 5 indexers),kindly guide me what next to do?

Thank you in advance!

Labels (1)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pacifikn,

as described at https://splunkbase.splunk.com/app/3249/#/details, you have to deploy this Add-on on:

  • SHs, using Deployer (if clustered) or manually,
  • IDXs, using Master Noder (if clustered) or manually,
  • HFs, if present, by Deployment Server or manually.

Ciao.

Giuseppe

0 Karma

pacifikn
Communicator

Hi @gcusello  thank you for your prompt response,

I have seen the link but it's bit complicated to understand , I have checked https://splunkbase.splunk.com/app/3249/?_gl=1*176xpt6*_ga*MTI2NzYyMjM0NC4xNjUwNTcxNDAz*_gid*MTc4MTA3...

But the steps are not clear for me, I would like your assistance if possible and provide me the steps to do on each of the listed components:

  • SHs, manually ( Already done via GUI) 
  • IDXs, manually, (steps to do this in CLI cause i'm using CentOS)
  • HFs, manually. (steps?)

Kindly help me with the steps to do this, Thank you in advance.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pacifikn,

I suppose that there some dns problem because sometimes I have strange addresses, anyway the informations are at https://splunkbase.splunk.com/app/3249/#/details

Anyway,

You configured this TA on SH and it's immediate

Then you have to install it on indexers anf HFs and should be the same because you can use the GUI.

If you don't want to use the GUi you have to:

  • copy it on the destination,
  • unpack it on $SPLUNK_HOME/etc/apps
  • copy default/inputs.conf in local/inputs.conf, if the folder doesn't exist, create it,
  • add informations in local/inputs.conf:
    • port
    • fortimail_ip_address
  • you could also add the index in the stanza
  • restart Splunk on that server
  • then you have to check the route between fortimail and Splunk
  • then you have to configure your fortimail to send logs to Splunk

Ciao

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...