About rpille_splunk

rpille_splunk · ‎09-05-2017

Yes, you are correct. The Splunk Add-on for McAfee Web Gateway should be compatible with 6.6.X, because new Splunk releases are backward-compatible with add-ons that supports a previous version unless the add-on docs specifically say otherwise. I've updated Splunkbase to reflect this.

rpille_splunk · ‎09-05-2017

Yes, you are correct. The Splunk Add-on for Symantec DLP should be compatible with 6.6.X, because new Splunk releases are backward-compatible with add-ons that supports a previous version unless the add-on docs specifically say otherwise. I've updated Splunkbase to reflect this.

rpille_splunk · ‎08-23-2017

It should be supported in a standalone Splunk platform instance, yes. Those doc instructions only cover a distributed case because that requires special instructions, but all add-ons are supported on standalone instances unless stated otherwise. As for why no data is showing in the dashboards, I'm not sure. Are the dashboards searching against the index that you sent the New Relic data to? Is the Role that your Splunk user is part of able to see the data in those indexes by default? You may need to add the index to the Selected Indexes list in Access Controls > Roles > .

rpille_splunk · ‎08-21-2017

That's correct. The Splunk Add-on for Akamai collects data from Akamai Cloud Monitor, so it is CDN data not WAF data in this case.

rpille_splunk · ‎08-17-2017

I forgot to add, your data collection instance has to be running Linux.

rpille_splunk · ‎08-17-2017

Hi Darla, This add-on is supported in a single-instance deployment of the Splunk platform, so you can install it on your single instance and configure input collection there, and that should be supported. If you have a distributed deployment, per the documentation, you should set up a heavy forwarder (a full Splunk Enterprise instance) to handle your data inputs. (This add-on does not support universal forwarders for data collection.) Install the add-on on BOTH your search head and your heavy forwarder, but configure the add-on on your heavy forwarder only. Make sure you are using an account that has the admin role when you perform the configuration. Here is the installation documentation: http://docs.splunk.com/Documentation/AddOns/released/Box/Install

rpille_splunk · ‎08-15-2017

Thanks for this question, rjthibod. We're looking into it and will post an answer soon.

rpille_splunk · ‎08-15-2017

Hi Shubham, That documentation page that you were following is the right one to have open while you work through the deployment process. Follow the links to the pages about deploying add-ons in a distributed environment, and also review the documentation (or, if no online documentation is available, read the readme files) of each add-on to determine where you need to deploy it and any limitations about how you should do so. Each add-on is different, so you need to read each doc for each add-on.

rpille_splunk · ‎08-07-2017

Watchers, I've updated the Answer above with the latest information. Thanks for raising these issues!

rpille_splunk · ‎07-13-2017

Thanks, dwaddle and sideview both. I'm working with the product team on all these excellent questions and will update with answers when I have them.

rpille_splunk · ‎07-12-2017

I've updated my answer with some further info about the second part of the question, and will update it again with better information about the licensing for the Splunk code. Thanks!

rpille_splunk · ‎07-11-2017

Hi dwaddle, great questions! To address the first part of your question: I've added a section in the doc for the recently released 2.2.0 version that I hope will cover what you need. Each credit also specifies which version of the library is included. See http://docs.splunk.com/Documentation/AddonBuilder/2.2.0/UserGuide/Validate#Credit_third-party_libraries Please upgrade to 2.2.0 and repackage any existing TA projects with this new version to bring your libraries up to date. Your points above and in comments below about the Splunk license agreement make sense, so we've updated the license that applies to Add-on Builder with this new one: https://www.splunk.com/en_us/legal/splunk-app-end-user-license-agreement.html Note that the license in the 2.2.0 package currently is out of date, and there's a known issue filed to fix that in the next release. For the second part of your question, I've asked an engineer whether AOB would auto-update the library packaged in your TA if you edit it with a later version of AOB (assuming that later version of AOB includes a later version of the library.) The answer is yes. If any dependency changes in the new version of AOB, it will be updated in the TA when you repackage it with the new version of AOB.

rpille_splunk · ‎05-31-2017

You found a bug! It should be fixed now. Please try searching for it again and let me know if it still doesn't show up. Thanks very much.

rpille_splunk · ‎04-18-2017

Go to the CIM setup page and tune the max time and backfill time. See http://docs.splunk.com/Documentation/CIM/4.7.0/User/Setup#Accelerate_CIM_data_models Further details here: http://docs.splunk.com/Documentation/Splunk/6.5.3/Knowledge/Acceleratedatamodels#When_summary-populating_searches_take_too_long_to_run

rpille_splunk · ‎04-17-2017

Make sure you are making your acceleration setting changes in the Data Model Acceleration Enforcement modular input on your search head. ES overrides any acceleration changes you try to make elsewhere. The Email data model is accelerated by ES by default, so you probably should not need to make changes here unless someone went to this modular input and deaccelerated the model. Next, you can adjust the settings on the CIM setup for the Email data model to see if tweaking the settings there helps the data model finish building.

rpille_splunk · ‎03-30-2017

Use https://splunkbase.splunk.com/app/2790/, as it is CIM compatible.

rpille_splunk · ‎03-30-2017

I'm not familiar with that add-on, so this advice is generic. If you've tried manually configuring it on the new forwarder, then I'd suggest disabling the add-on on the first forwarder and trying again. If that doesn't work, look for all of the ways in which the new forwarder is different from the one on which you installed the add-on for testing, or anything that might be different about the configuration on the new forwarder vs the old one. Perhaps your API key expired? Perhaps you've exceeded your rate limit with the number of API calls you already made? Perhaps your browser is caching different credentials when you configure your connection to the API?

rpille_splunk · ‎03-30-2017

Try configuring it without copying over the configurations from the first forwarder. Because this add-on involves credentials, copying over the files probably will not work.

rpille_splunk · ‎03-30-2017

Why are you trying to configure the add-on on two different heavy forwarders? Are you planning to manually split input collection between two heavy forwarders without overlapping them? Which add-on is this?

rpille_splunk · ‎02-09-2017

And here is the link to the documentation about app imports: http://docs.splunk.com/Documentation/ES/4.6.0/Install/InstallTechnologyAdd-ons#Import_custom_apps_and_add-ons

rpille_splunk · ‎01-30-2017

Hi there! Have you tried the troubleshooting steps in the docs? Here they are for reference: http://docs.splunk.com/Documentation/AddOns/released/Box/Troubleshooting

rpille_splunk · ‎01-20-2017

Hi Guarisma, That add-on is provided by Cisco, so they're the ones providing the docs for it. The contact information for questions and support is in the Splunkbase details tab, at the bottom: https://splunkbase.splunk.com/app/1897/#/details You can also probably infer the model mapping my examining the add-on's tags.conf and eventtypes.conf files and comparing the tags you see there to the CIM documentation. Hope that helps!

rpille_splunk · ‎01-17-2017

What version of Enterprise Security are you running on what version of the Splunk platform? Have you checked that your version of ES is supported on the version of the Splunk platform you are using?

rpille_splunk · ‎12-15-2016

Hi Harishma, Yes, it is possible to accidentally create duplicates using this manual method, so when you select the topics to collect on each forwarder, you have to ensure that you don't collect the same topics from more than one forwarder. The documentation for the steps to follow is here: http://docs.splunk.com/Documentation/AddOns/released/Kafka/Configuremodularinputs#Manage_inputs_manually_from_each_forwarder If you want instead to have the topic collection split up over several heavy forwarders automatically, use this method instead: http://docs.splunk.com/Documentation/AddOns/released/Kafka/Configuremodularinputs#Manage_inputs_centrally_from_a_single_node

rpille_splunk · ‎12-12-2016

Hi sarnagar, I can't speak to what other Kafka-related apps do, but the Splunk Add-on for Kafka is built by and supported by Splunk, and it provides a modular input that allows you to ingest Kafka topic messages into the Splunk platform. Docs are here: http://docs.splunk.com/Documentation/AddOns/latest/Kafka/About Hope this helps.

Posts	185
Solutions	40
Karma Given	53
Karma Received	147
Member Since	‎08-21-2014

Online Status	Offline
Date Last Visited	‎03-14-2023 10:32 AM

When is the new version of the Splunk Add-on for C...

Re: Is Splunk Add-on for McAfee Web Gateway compat...

Re: Is the Splunk Add-on for Symantec DLP compatib...

Re: Why aren't the Splunk Add-on and App for New R...

Re: CIM compliance

Re: Can I install the Splunk Add-on for Box on jus...

Re: Can I install the Splunk Add-on for Box on jus...

Re: Licensing of Free Splunk-built Apps

Re: Splunk Enterprise Security: How to deploy the ...

Re: Governance and Licensing for Add-on Builder de...

Re: Governance and Licensing for Add-on Builder de...

Re: Governance and Licensing for Add-on Builder de...

Re: Governance and Licensing for Add-on Builder de...

Re: Splunk Add-on for Amazon Web Services: Why am ...

Re: Splunk Common Information Model (CIM): Why is ...

Re: Splunk Common Information Model (CIM): Why is ...

Re: What is the best Splunkbase app for Carbon Bla...

Re: How to resolve the Fail to update configuratio...

Re: How to resolve the Fail to update configuratio...

Re: How to resolve the Fail to update configuratio...

Re: Why cant Enterprise Security App see data from...

Re: Splunk Add-on for Box not receiving any data

Re: Cisco ACI Add-on for Splunk Enterprise: What C...

Re: Splunk Enterprise Security: Using Splunk 6.5.1...

Re: Splunk Add-on for Kafka: Does managing inputs ...

Re: What's the difference between Splunk Add-on fo...

Are you a member of the Splunk Community?