After spending what feels like too much time on this project, I am getting the strong idea that Splunk Light simply doesn't support the Bro add-on. (Yes, I know that the download page specifies it's only for the Enterprise edition, but the installation instructions cover any/all versions.)
Thank you,
Terence
Hi Terence,
Excellent question. Splunk Light currently supports only a limited number of add-ons, which you can browse in their in-product add-on browser. The list of add-ons that are supported here may change in future releases, which is why individual add-on documents do not specify whether or not it is supported on Splunk Light (or Splunk Cloud, where the same situation applies.) If you have a strong need for this add-on in Splunk Light, I encourage you to file a support case and further explain your use case.
Thanks!
~ Robin
Robin,
With respect, it feels like you haven't really addressed the meat of my three questions.
Thanks, and thanks for sticking with me on this quest.
Thanks, Terence, for your feedback. We are working on ways to help clarify up front which components are supported in Splunk Light and Splunk Cloud, so I hope that your frustration will not be repeated.
We'll get in touch with you separately to resolve this with you. Thanks again for raising these questions!