Hardware and software requirements for the Splunk Add-on for Carbon Black

Carbon Black requirements

This add-on consumes JSON event data produced by the Carbon Black Event Forwarder utility (cb-event-forwarder). The recommended collection method is to send events directly to a Splunk HTTP Event Collector (HEC) input. You can alternatively configure the Event Forwarder to write JSON files and use a Splunk file monitor to collect them.

Do not configure HEC and file monitoring for the same Event Forwarder output, because doing so duplicates data. The Event Forwarder and its installation instructions are available in the cb-event-forwarder GitHub repository.

Splunk platform requirements

Because this add-on runs on the Splunk platform, all of the system requirements apply for the Splunk software that you use to run this add-on.

Splunk Enterprise

For Splunk Enterprise system requirements, see System requirements for use of Splunk Enterprise on-premises in the Splunk Enterprise Installation Manual.

Splunk Cloud Platform

If you are managing on-premises forwarders to get data into Splunk Cloud Platform, see System requirements for use of Splunk Enterprise on-premises in the Splunk Enterprise Installation Manual, which includes information about forwarders.