Splunk Enterprise Security

How to make URL Toolbox available from the Splunk App for Enterprise Security?

mdessus_splunk
Splunk Employee
Splunk Employee

Since ES filters apps imported by name (TA... ), you need to force the import by modifying the file /opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/local/inputs.conf and changing the app_regex in the stanza [app_imports_update://update_es]:

[app_imports_update://update_es]
app_regex = utbox
disabled = 0
1 Solution

mdessus_splunk
Splunk Employee
Splunk Employee

Note that in ES versions 4.7 and later, you can do it from the interface: http://docs.splunk.com/Documentation/ES/4.7.1/Install/ImportCustomApps

View solution in original post

mdessus_splunk
Splunk Employee
Splunk Employee

Note that in ES versions 4.7 and later, you can do it from the interface: http://docs.splunk.com/Documentation/ES/4.7.1/Install/ImportCustomApps

View solution in original post

mdessus_splunk
Splunk Employee
Splunk Employee

According to some fellow splunkers, the regex should be more similar to that one:

app_regex = ([DST]A-.)|(Splunk_[DST]A_.)|(SplunkEnterpriseSecuritySuite)|(utbox)

0 Karma

mdessus_splunk
Splunk Employee
Splunk Employee

And the answer in the already in the question 🙂

mdessus_splunk
Splunk Employee
Splunk Employee

Note that this seems to cause an issue when upgrading (at least) to ES 4.0. Remove this setting before !
I'll report this issue.

0 Karma

mdessus_splunk
Splunk Employee
Splunk Employee

Should be fixed in ES 4.0.1.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!