Splunk Enterprise Security

Splunk App for ES Health Check: How to add and list multiple indexers?

ronj_clark
Explorer

I have the Splunk App for ES Health Check running. In the configuration, I have the dedicated ES (Enterprise Security) Search Head listed, but only 1 of 3 indexers listed. How do I add the other 2 indexers and have the app still work?
I have tried entering in something like this in the UI: "indexer01","indexer02"

That only gave an error message in the app when I saved and reloaded.

Any idea if this is possible to list multiple indexers?

Thanks,
Ron C

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

There are macro definitions for the indexers and search heads in this app. You need to update these. Refer to docs here :

http://docs.splunk.com/Documentation/ESHealthCheck/1.0.0/UserGuide/Install

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...