Sorry for the 4 year resurrection of the thread,  but I was wondering if this lead anywhere.   Working with lookups for assets and identities in ES and finding issues with the use / inconsistancies with the way 'make_ip_cidr' operates.    For ES population,  I'm trying to use MV in KV stores of assets,  as well as delimited csv lookups -  but the cidr matching,  make_ip_cidr and expandiprange  and the lack of support of /32 is causing issues.  ... View more

The only thing I found worked was to perform the following steps: 1. Change directories to: /opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/install 2.  Execute the following command: for i in *.spl; do /opt/splunk/bin/splunk install app $i; done 3. Change is_configured = 0 to is_configured = 1 in /opt/etc/apps/SplunkEnterpriseSecuritySuite/local/app.conf 3. Restart Splunk services NOTE: Also works on 6.4.0 ... View more

SII was for splunklight, it was not intended to be multi tenant, initially. SAI is an app for enterprise, but the setup UI still assume that you have single instance (SH/IDX all in one). So when you are in an enterprise splunk deployment, read the docs : https://docs.splunk.com/Documentation/InfraApp/2.0.0/Install/DistributedDeployment You do not really want to send data to the SH , its a bottleneck, and HEC may not scale. Instead move the ingest on the indexers. you need to create the HEC tokens and inputs on the indexers, install the TA (with sourcetypes and indexes) setup a DNS loadbalancer to have a single address for all your indexers then customize the install script for the client to use the good token and the indexers addresses ... View more