All Apps and Add-ons

Can I use it without the app?

rdownie
Communicator

Can I use fireeye without the app? We created the sourcetype/index added a user account in splunk and configured the fireeye appliance using the XML POST string. Do we need anything else? Also, if we want to use a forwarder is that do-able?
Thanks,
-Bob

Tags (1)
0 Karma
1 Solution

rdownie
Communicator

Yes you can. Works like any other data coming in. Just forward data to Splunk using the mechanism provided by the fire eye. We had it forward it in XML and used kvmode=xml to auto extract, used field aliases to simplify/shorten the field names.

View solution in original post

0 Karma

rdownie
Communicator

Yes you can. Works like any other data coming in. Just forward data to Splunk using the mechanism provided by the fire eye. We had it forward it in XML and used kvmode=xml to auto extract, used field aliases to simplify/shorten the field names.

0 Karma

jbrodsky_splunk
Splunk Employee
Splunk Employee

I think you posted this three times, Bob - you might want to check that. But in general, splunk apps are entirely OPTIONAL for any given data source. There's no reason you can't bring the data from any datasource into "core Splunk" and then use Splunk to perform your regular searches/field extractions/event typing/reporrting/dashboarding. However, apps generally get you much more value in an "out of the box" fashion.

I doubt sincerely that you will be able to get a standard Splunk forwarder onto your appliance, nor that Fireeye would consider that a supported configuration.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...