Install Splunk Asset and Risk Intelligence Echo

To install Splunk Asset and Risk Intelligence Echo, complete the following steps:

1. Install Splunk Asset and Risk Intelligence Echo on a secondary search head. You can download Splunk Asset and Risk Intelligence Echo from Splunkbase.

   The Splunkbase link for Splunk Asset and Risk Intelligence Echo is restricted for only approved downloaders.

   The process is the same as installing Splunk Asset and Risk Intelligence on a primary search head. For more details, see Install Splunk Asset and Risk Intelligence on a single search head or a search head cluster in the Install and Upgrade Splunk Asset and Risk Intelligence manual.
2. Set up roles and capabilities. The process for adding roles and managing their capabilities is the same as that of Splunk Asset and Risk Intelligence. See Set up roles and capabilities for Splunk Asset and Risk Intelligence in the Install and Upgrade Splunk Asset and Risk Intelligence manual.
3. Initialize the app for a new install.
   1. In Splunk Asset and Risk Intelligence Echo, select Admin, then select Install and upgrade helper.
   2. In the Initialize a new install section, select Check data for Permissions, Internal lookups, and Enrichment rules. Checking this data verifies and populates all the internal lookups and enrichment rules for Splunk Asset and Risk Intelligence. After you complete these steps, the Check data dialogue box displays "Success".

After you install the app, you can sync data between the primary and secondary search heads. See Manage synchronization between Splunk Asset and Risk Intelligence Echo and the primary search head.