Splunk Enterprise Security

Splunk Enterprise Security: How to deploy the included add-ons to forwarders?

shubham87
Explorer

I have recently deployed Splunk Enterprise Security (ES) on one of our Search Heads. While installing, it could not proceed, since I had two add-ons already installed (Splunk Add-on for Microsoft Windows and Splunk Add-on for Tenable) using my deployment server. I removed those add-ons from the deployment server and I was able to install ES. Now, one section in ES documentation says, "Deploy add-ons included with Splunk Enterprise Security": http://docs.splunk.com/Documentation/ES/4.7.2/Install/InstallTechnologyAdd-ons

Now my question is, how should i deploy these add-ons to my forwarders? Shall i use deployment server to deploy them? Or it conflicts with ES? I am confused.

Regards
Shubham

0 Karma

rpille_splunk
Splunk Employee
Splunk Employee

Hi Shubham,
That documentation page that you were following is the right one to have open while you work through the deployment process. Follow the links to the pages about deploying add-ons in a distributed environment, and also review the documentation (or, if no online documentation is available, read the readme files) of each add-on to determine where you need to deploy it and any limitations about how you should do so. Each add-on is different, so you need to read each doc for each add-on.

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...