Splunk Enterprise Security

How to make URL Toolbox available from the Splunk App for Enterprise Security?

mdessus_splunk
Splunk Employee
Splunk Employee

Since ES filters apps imported by name (TA... ), you need to force the import by modifying the file /opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/local/inputs.conf and changing the app_regex in the stanza [app_imports_update://update_es]:

[app_imports_update://update_es]
app_regex = utbox
disabled = 0
1 Solution

mdessus_splunk
Splunk Employee
Splunk Employee

Note that in ES versions 4.7 and later, you can do it from the interface: http://docs.splunk.com/Documentation/ES/4.7.1/Install/ImportCustomApps

View solution in original post

mdessus_splunk
Splunk Employee
Splunk Employee

Note that in ES versions 4.7 and later, you can do it from the interface: http://docs.splunk.com/Documentation/ES/4.7.1/Install/ImportCustomApps

mdessus_splunk
Splunk Employee
Splunk Employee

According to some fellow splunkers, the regex should be more similar to that one:

app_regex = ([DST]A-.)|(Splunk_[DST]A_.)|(SplunkEnterpriseSecuritySuite)|(utbox)

0 Karma

mdessus_splunk
Splunk Employee
Splunk Employee

And the answer in the already in the question 🙂

mdessus_splunk
Splunk Employee
Splunk Employee

Note that this seems to cause an issue when upgrading (at least) to ES 4.0. Remove this setting before !
I'll report this issue.

0 Karma

mdessus_splunk
Splunk Employee
Splunk Employee

Should be fixed in ES 4.0.1.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...