Can I install Extreme Search without Splunk Enterprise Security?

[noybin]

Can I install and use Extreme Search without Enterprise Seurity?

If yes, where should be installed (Search Head, Indexers)?

Any recommendations to consider?

Thank you very much.

[jdeer0618]

Can't hurt to ask your sales rep or SE if you have one. They might be able to hook you up with Extreme Search as a standalone app.

[ChrisG · Accepted solution]

It is part of Splunk Enterprise Security now, as you mentioned. So I guess the answer to your question is really "no, you can't use extreme search without Enterprise Security." 😕

[noybin]

So What about the comment from the Extreme Search Visualization app that says:
"It is not necessary to use the XSV app or the Splunk App for Enterprise Security to use Extreme Search. Since Extreme Search is implemented as a set of extensions to Splunk's search language, it is available to any Splunk app."?

[starcher]

If you are an ES customer or can get your rep to provide XS you can install it. There is no actual dependance from an install standpoint on ES. Many ES customers use it on other search heads once they have it via their ES license.

[ChrisG]

I think that comment is outdated? It used to be true and it no longer is. Scianta's web site says "Extreme Search for Splunk is now owned and supported by Splunk Inc. It currently ships as part of the Splunk App for Enterprise Security."

[gjanders]

The application still has python files and the various commands such as xsvcreateconcept so I thought it would work. I have not tested it yet though...

[gjanders]

As per the Extreme Search Visualisation page

It is not necessary to use the XSV app
or the Splunk App for Enterprise
Security to use Extreme Search. Since
Extreme Search is implemented as a set
of extensions to Splunk's search
language, it is available to any
Splunk app.

Just install the application on your search head,

[noybin]

Thank you!

[ChrisG]

That is just the visualization support. Extreme Search itself is no longer available as a separate app.

[noybin]

So how can I use Extreme search then?