Checkpoint logs in splunk requirements

[clymbouris]

Hi,

I've been asked to configure this in our environment and I was hoping to get a quick answer in these questions:

1) Does the indexer/searchhead need to run on Linux/Solaris OS? Or will Windows Server do?

2) Does anyone know if this would work on R76?

Many thanks

[Chubbybunny · Accepted solution]

The Indexer/Searchhead can be any of the supported platforms, however, due to the nature of the Splunk OPSEC LEA app, you'll need to run it on Linux or Solaris (typically a Heavy Forwarder). Please refer to the online docs below.

splunk-add-on-for-check-point-opsec-lea-linux

splunk-add-on-for-check-point-opsec-lea-solaris

Yes, R76 is supported.