All Apps and Add-ons

How can I install the CEF Extraction Add-on for Splunk Enterprise?

Nistrom
New Member

I'm not using the Distributed Deployment, so I can't understand the guide in the documentation for this add-on. I have installed Splunk Enterprise and want it to index and search CEF files. Anyone can help? Thank you.

0 Karma
1 Solution

IgorB
Path Finder

All you need to do is install the add-on and make sure your CEF data's sourcetype is "cefevents"

View solution in original post

IgorB
Path Finder

All you need to do is install the add-on and make sure your CEF data's sourcetype is "cefevents"

tmaltizo
Path Finder

Hi...I wanted to followup on this question, if I may, as we are looking at installing this add-on. We are using Distributed deployment. So, does this addon get installed on the Forwarder? If so, the Forwarder client is on Linux. So, being a *nix novice, would we just run the tar command?

0 Karma

jeremiahc4
Builder

@tmaltizo
Hopefully you figured it out or asked in a new thread. For installing to your forwarder in a distributed env, hopefully you have a deployment server and would unzip the tgz into the deployment-apps folder there, then assign it to your forwarder via serverclass.conf entry.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...