Install Splunk Asset and Risk Intelligence Echo

To install Splunk Asset and Risk Intelligence Echo, complete the following steps:

1. Install Splunk Asset and Risk Intelligence Echo on a secondary search head. You can download Splunk Asset and Risk Intelligence Echo from Splunkbase.

   The Splunkbase link for Splunk Asset and Risk Intelligence Echo is restricted for only approved downloaders.

   The process is the same as installing Splunk Asset and Risk Intelligence on a primary search head. For more details, see Install Splunk Asset and Risk Intelligence on a single search head or a search head cluster in the Install and Upgrade Splunk Asset and Risk Intelligence manual.
2. Set up roles and capabilities. The process for adding roles and managing their capabilities is the same as that of Splunk Asset and Risk Intelligence. See Set up roles and capabilities for Splunk Asset and Risk Intelligence in the Install and Upgrade Splunk Asset and Risk Intelligence manual.
3. Initialize the app for a new install.
   1. In Splunk Asset and Risk Intelligence Echo, select Admin, then select Post-install configuration.
   2. Select Start configuration process. This process verifies and populates all the internal lookups and enrichment rules for Splunk Asset and Risk Intelligence.
   3. (Optional) Select the Show actions log check box to see which actions take place during the configuration process. You can also opt to Show skipped actions by selecting the check box.

After you install the app, you can sync data between the primary and secondary search heads. See Manage synchronization between Splunk Asset and Risk Intelligence Echo and the primary search head.