I have a multi-node indexer cluster with a 3 node search head cluster and two load balanced Heavy forwarders in my Splunk environment. The security team has requested that we install & get the Splunk App for Dropbox for Business working. Does anybody know what the actual steps are in getting the app working in such an environment? Ideally, the connection to Dropbox will be initiated by HFs and sent to Indexers.
Finally got this working in my environment. The lack of documentation is very frustrating.
Create Dropbox index on the Index Cluster
Install Dropbox App on Heavy Forwarder
Rename indexes.conf in default folder on HF
Add outputs.conf pointing to my IndexCluster in local folder of Dropbox App on HF.
Install Dropbox App on Search Head Cluster.
Change the event-type "dfb_activity" to include "index=your index_name" sourcetype=dfb:activity instead of calling the macro. This is required to get the dashboard working within the application.
Finally got this working in my environment. The lack of documentation is very frustrating.
Create Dropbox index on the Index Cluster
Install Dropbox App on Heavy Forwarder
Rename indexes.conf in default folder on HF
Add outputs.conf pointing to my IndexCluster in local folder of Dropbox App on HF.
Install Dropbox App on Search Head Cluster.
Change the event-type "dfb_activity" to include "index=your index_name" sourcetype=dfb:activity instead of calling the macro. This is required to get the dashboard working within the application.
Hello! You must use the configuration bundle method. For more information read this first http://docs.splunk.com/Documentation/Splunk/6.3.3/Indexer/Managecommonconfigurations
ant then read this: http://docs.splunk.com/Documentation/Splunk/6.3.3/Indexer/Manageappdeployment
Thanks