Installation & Setup
How to install and configure the SCMA app for a successful assessment run — including where to install it, which user to run it as, handling multi-island environments, and upgrading from previous versions.
Standard installation
The SCMA should always run from a properly configured Monitoring Console (MC) when possible. The MC is the preferred location because it should have visibility into the entire Splunk environment.
If a Monitoring Console is not configured, install the app and run it from a Search Head that has the most access to the customer's environment.
Always validate that the latest version of the app is being used before starting an assessment. Refer to the Splunkbase compatibility list for supported Splunk Enterprise versions.
Who to run the app as
The app searches all data sources identified in the Pre-Flight Checks dashboard on the landing page. The user must have access to all of those data sources as well as the capabilities to run the following commands:
outputlookuprestcollect
The app also writes to the _introspection index. Based on these requirements,
it is easiest to run the app as an Admin user.
On macOS there are limitations around the _introspection index. Ignore
any error messages related to this if you are testing on a Mac.
Splunk Islands
There are times when a customer will have different "Splunk Islands" — separate installations of Splunk that do not communicate with each other.
Under these circumstances:
- Run the app in each Splunk Island separately.
- Give each island a unique customer name in the 1 - Set up page of the SCMA App. This allows results from multiple islands to be stacked together for analysis after the outputs are received.
- The customer should also provide an explanation and a diagram describing each island.
Upgrades
The SCMA handles upgrades like any other Splunk app. However, customers sometimes miss the checkbox required when upgrading. To avoid these issues:
-
Guide the customer to completely remove any previously installed
version of the SCMA:
- Linux/Unix:
$SPLUNK_HOME/etc/apps/scma - Windows:
%SPLUNK_HOME%\etc\apps\scma
- Linux/Unix:
- Restart Splunk after removing the old app.
- Install the latest version from Splunkbase.
This clean-install approach resolves 90%+ of issues experienced after an upgrade. Also clear browser cache if you see unexpected behavior after upgrading.
If the customer is running the latest version of the app, also ensure that there
is no local/ directory inside the app (e.g. $SPLUNK_HOME/etc/apps/scma/local/).
A local directory indicates the customer has edited the app, which can cause
unexpected behavior.
Preflight dashboard
The first dashboard panel a customer sees on the 1 - Set Up landing page is a table of PreFlight checks. Issues identified here are highlighted in red and should not be ignored.
Each issue should be resolved before moving forward. The checks are self-documenting — they explain exactly what they are looking for and provide remediation guidance.
The PreFlight checks identify issues with the customer's Splunk environment, not issues with the SCMA app itself. Use standard Splunk troubleshooting steps to resolve these issues.