Splunk Enterprise Security

Unable to deploy Enterprise Security add-ons to Indexers

cemiam
Path Finder

Hi,

I have 1 SH and 3 clustered indexers. I have installed Enterprise Security to SH and follow workaround to deploy add-ons to indexers. I have downloaded Splunk_TA_ForIndexers from the Enterprise Security and upload it under $SPLUNK_HOME/etc/master-apps on SH which is also configured as cluster master. Then hit Validate and Check Restart under Index Clustering > Edit > Configuration Bundle Actions but it didn't find anything to deploy. Active Bundle ID and Latest Bundle ID seems the same. What should I do to overcome such an issue?

Best Regards,

0 Karma

mayurr98
Super Champion
0 Karma

cemiam
Path Finder

Hi,

I am following this Create the "Splunk_TA_ForIndexers and manage deployment manually" procedure on link below. I have downloaded Splunk_TA_ForIndexers placed it under $SPLUNK_HOME/etc/master-apps on the Search Head.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...