- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can I install and use Extreme Search without Enterprise Seurity?
If yes, where should be installed (Search Head, Indexers)?
Any recommendations to consider?
Thank you very much.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


It is part of Splunk Enterprise Security now, as you mentioned. So I guess the answer to your question is really "no, you can't use extreme search without Enterprise Security." 😕
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can't hurt to ask your sales rep or SE if you have one. They might be able to hook you up with Extreme Search as a standalone app.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


It is part of Splunk Enterprise Security now, as you mentioned. So I guess the answer to your question is really "no, you can't use extreme search without Enterprise Security." 😕
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So What about the comment from the Extreme Search Visualization app that says:
"It is not necessary to use the XSV app or the Splunk App for Enterprise Security to use Extreme Search. Since Extreme Search is implemented as a set of extensions to Splunk's search language, it is available to any Splunk app."?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

If you are an ES customer or can get your rep to provide XS you can install it. There is no actual dependance from an install standpoint on ES. Many ES customers use it on other search heads once they have it via their ES license.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


I think that comment is outdated? It used to be true and it no longer is. Scianta's web site says "Extreme Search for Splunk is now owned and supported by Splunk Inc. It currently ships as part of the Splunk App for Enterprise Security."
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

The application still has python files and the various commands such as xsvcreateconcept so I thought it would work. I have not tested it yet though...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

As per the Extreme Search Visualisation page
It is not necessary to use the XSV app
or the Splunk App for Enterprise
Security to use Extreme Search. Since
Extreme Search is implemented as a set
of extensions to Splunk's search
language, it is available to any
Splunk app.
Just install the application on your search head,
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


That is just the visualization support. Extreme Search itself is no longer available as a separate app.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So how can I use Extreme search then?
