Deploy and Use Splunk App for CEF

Hardware and software requirements for the Splunk App for CEF

Platform requirements

The Splunk App for CEF requires Splunk Enterprise running on Linux or Windows. Tested versions for search heads and indexers include CentOS 7 x64 and Windows 2012 R2 x64. Refer to the Performance expectations for the Splunk App for CEF to estimate your sizing requirements.

For more information about other Splunk Enterprise hardware and software requirements, see System Requirements in the Installation Manual in the Splunk Enterprise documentation.

Splunk Enterprise version

The Splunk App for CEF works with Splunk Enterprise 7.2 and later.

KV store requirements

The Splunk App for CEF relies on the Splunk KV Store to store output group definitions. For more information about KV Store, including the system requirements, see About the app key value store in the Splunk Enterprise Admin manual.

Browser compatibility

The Splunk App for CEF is compatible with the same browsers as Splunk Enterprise. See Supported browsers in the Splunk Enterprise Installation Manual for details.

Splunk ACL requirements

The Splunk App for CEF requires the rtsearch, schedule_search and schedule_rtsearch capabilities to configure the searches and distribute the output group configuration to your indexers.

Resource requirements

The Splunk App for CEF requires a distributed Splunk Enterprise environment. During the installation or upgrade process, you install the Splunk App for CEF on a search head to configure the output mapping, then install the Splunk Add-on for CEF Output, which the app creates for you, to your indexers.

See Performance expectations for the Splunk App for CEF for reference information that you can use to size your deployment.

Data models

Deploying the Splunk App for CEF requires you to be familiar with the concept of data models, because using the Splunk App for CEF involves manually mapping attributes from the data model to fields in CEF.

If you have defined your own data models to which you want to map your data, you are ready to use the Splunk App for CEF. If not, consider installing the Splunk Common Information Model (CIM) Add-on, which includes many preconfigured data models.