Does the Elasticsplunk app no longer exist?

[splunkcol]

Hello,

I have noticed that the Elasticsplunk app no longer exists https://splunkbase.splunk.com/app/3493 I do not know if you know what the reason is or if it was updated by another APP I would appreciate if you could inform me.

At this moment I need to use that APP or the one that allows me to use the query with the "ess" command.

If possible it would help me a lot which are the configuration files that I have to modify both on splunk and Elasticsearch side.

[splunkcol · Accepted solution]

After investigating, the elasticsplunk plug-in has indeed disappeared.

After version 8.1 splunk moved from Python 2 to python 3 since then all apps should be on that version of python.

What I did was to install a version prior to Splunk 8.1 and copied and pasted the elasticsplunk folder that I got from a github repository and it worked correctly.

In this case I have clear that I can not ask for support because I am working with a very old version of splunk and for which there is no support anymore.

[VatsalJagani]

@splunkcol - Either Splunk or the App developer can give an accurate answer why it has been removed. Because generally Apps are being archived when it is replaced with something else and not removed all together.

But you can try searching for Elastic search related integration and there are many other available on Splunkbase that you can see if it solves your purpose.

- https://splunkbase.splunk.com/apps?keyword=elastic

Kindly upvote if you find it useful!!!