Splunk Search

ES vs Non-ES search, ES does not show modified TA-tippingpoint fields

it7272
Engager

After modifying and renaming the TippingPoint TA, I installed it and I can now see that it is working in Non-ES Search Head and on the ES search head out side of the Enterprise Security application.

Splunk version 5.0.1
Current app: Enterprise Security
version 2.2.0, build 144974

From: https://splunk-ess.domain.com:8000/en-US/app/search/dashboard_live
Search: index="test" sourcetype="tippingpoint"
Result: Works! Tipping point fields are listed for the data.

From: https://splunk-ess.domain.com:8000/en-US/app/SplunkEnterpriseSecuritySuite/flashtimeline
Search: index="test" sourcetype="tippingpoint"
Result: Does NOT Works! Tipping point fields Don't show up.

Question 1: Does changing the name of the TA make a difference to ESS app?
Question 2: Could this be some role, with the user having access to the new TA?
Question 3: Could this be a compatibility issue?

Tags (1)
0 Karma
1 Solution

sbrant_splunk
Splunk Employee
Splunk Employee

In ES 2.2.0, only TAs with a name that begins with "TA-" and "Splunk_TA_" will be imported into the configuration by default and then only during setup. To add a custom TA, you must take steps to include it into the configuration and rerun the setup step of ES. This is not as bad as it sounds and is described here:

http://docs.splunk.com/Documentation/ES/latest/Install/InstallTechnologyAdd-ons

The point of this new feature is to eliminate conflicts with TAs that are incompatible with ES.

View solution in original post

sbrant_splunk
Splunk Employee
Splunk Employee

In ES 2.2.0, only TAs with a name that begins with "TA-" and "Splunk_TA_" will be imported into the configuration by default and then only during setup. To add a custom TA, you must take steps to include it into the configuration and rerun the setup step of ES. This is not as bad as it sounds and is described here:

http://docs.splunk.com/Documentation/ES/latest/Install/InstallTechnologyAdd-ons

The point of this new feature is to eliminate conflicts with TAs that are incompatible with ES.

View solution in original post

it7272
Engager

Thank you, that did the trick!

I opted to add the stanza to (/opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/local/inputs.conf) add (companyname_TA_.*)

I went with this option because we add the company name in front of each modified TA and this method will catch all of them.

[app_imports_update://update_es]
disabled = 0
app_regex = (TA-.)|(Splunk_TA_.)|(companyname_TA_.)|(sideview_utils)|(SplunkEnterpriseSecuritySuite)|(DA-.)|(SA-.*)

  1. Save changes
  2. Go to Manager > Apps > Enterprise Security > Setup. Click OK.
  3. Restart Splunk
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!