Hardware and software requirements for the Splunk App for CEF
The Splunk App for CEF requires Splunk Enterprise running on Linux or Windows. Tested versions for search heads and indexers include CentOS 7 x64 and Windows 2012 R2 x64. Refer to the Performance expectations for the Splunk App for CEF to estimate your sizing requirements.
For more information about other Splunk Enterprise hardware and software requirements, see System Requirements in the Installation Manual in the Splunk Enterprise documentation.
Splunk Enterprise version
The Splunk App for CEF works with Splunk Enterprise 7.2 and later.
KV store requirements
The Splunk App for CEF relies on the Splunk KV Store to store output group definitions. For more information about KV Store, including the system requirements, see About the app key value store in the Splunk Enterprise Admin manual.
The Splunk App for CEF is compatible with the same browsers as Splunk Enterprise. See Supported browsers in the Splunk Enterprise Installation Manual for details.
Splunk ACL requirements
The Splunk App for CEF requires the
schedule_rtsearch capabilities to configure the searches and distribute the output group configuration to your indexers.
The Splunk App for CEF requires a distributed Splunk Enterprise environment. During the installation or upgrade process, you install the Splunk App for CEF on a search head to configure the output mapping, then install the Splunk Add-on for CEF Output, which the app creates for you, to your indexers.
See Performance expectations for the Splunk App for CEF for reference information that you can use to size your deployment.
Deploying the Splunk App for CEF requires you to be familiar with the concept of data models, because using the Splunk App for CEF involves manually mapping attributes from the data model to fields in CEF.
If you have defined your own data models to which you want to map your data, you are ready to use the Splunk App for CEF. If not, consider installing the Splunk Common Information Model (CIM) Add-on, which includes many preconfigured data models.
Installation and configuration overview for the Splunk App for CEF
Performance expectations for the Splunk App for CEF
This documentation applies to the following versions of Splunk® App for CEF: 2.2.0, 2.3.0