Splunk Security Essentials

[bennett_riegel]

I've downloaded the splunk security essential files all into my laptop, but I can't figure out how to upload into into splunk enterprise as an app. What is my next step and where do I go to do this?

[isoutamo]

Hi

you should follow these instructions https://docs.splunk.com/Documentation/SSE/3.7.1/Install/InstallSSE

If you have different version then select correct documentation based on your version.

r. Ismo

[inventsekar]

>>> I've downloaded the splunk security essential files all into my laptop

May we know if you downloaded the single tar file (For example, ..splunk-security-essentials_371.tgz)

>>> but I can't figure out how to upload into into splunk enterprise as an app. What is my next step and where do I go to do this?

after downloading that tar file (for example..."splunk-security-essentials_371.tgz"), on your splunk, pls go to 

(left side Apps dropdown) Apps -- - > Manage Apps --- > Install app from file.

then select the tar file and load it, it will install smoothly.. then splunk restart will be required. 

[bennett_riegel]

I'm in the install app from file section, and I've downloaded the security essentials, but I don't see a file to put in there. What is the exact name of it because I feel like I've tried all of them? 

[inventsekar]

Hi @bennett_riegel 
1. did you download the app as a tar file from the Splunkbase
(the file name looks like "splunk-security-essentials_371.tgz")

2. on your Splunk, pls go to 

(left side Apps dropdown) Apps -- - > Manage Apps --- > Install app from file.

3. then select the tar file("splunk-security-essentials_371.tgz") and load it, it will install smoothly..
4. then Splunk restart will be required.