Splunk® Supported Add-ons

Splunk Add-on for Carbon Black

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Upgrade the Splunk Add-on for Carbon Black

The following upgrade steps provide a directory monitoring approach that ensures that rolled-over JSON files are not unmonitored if your Splunk platform deployment is down for some amount of time.

If your Splunk platform instance has been down, preventing the ingestion of files, switching from file monitoring to directory monitoring could result in a temporary spike in missed data being ingested

Change file monitoring to directory monitoring

  1. Download and install version 2.0.0 or higher of the Splunk Add-on for Carbon Black.
  2. Navigate to $SPLUNK_HOME/etc/apps/Splunk_TA_bit9-carbonblack/local, and open inputs.conf in a text editor.
  3. Change the existing monitoring path from <path_of_the_json_file> to <path_of_the_directory_containing_json_file>.
  4. Add whitelist = <regex_to_match_json_files>. See the inputs.conf.template in $SPLUNK_HOME/etc/apps/Splunk_TA_bit9-carbonblack/default/ for reference.
  5. Replace <regex_to_match_json_files> with a regular expression, in order to monitor the required JSON files. For example, .*\.json(\.[\d\-T:\.a-z]*)? will match the following type of files event_bridge_output.json.2019-05-13T11:41:28.167.restart, event_bridge_output.json.20190417, event_bridge_output.json.
  6. Save your changes.
  7. Restart your data collection node.
Last modified on 21 July, 2021
PREVIOUS
Install the Splunk Add-on for Carbon Black
  NEXT
Configure Carbon Black Instance to Generate events to send to Splunk

This documentation applies to the following versions of Splunk® Supported Add-ons: released


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters