Splunk Support with R80.10

[Rajput_Arvind]

Hi All,

We are upgrading MDS from R77.30 to R80.10. Currently Splunk is integrated with R77.30 MDS. Do we need to perform any step on R80.10 MDS to make the Splunk work with R80.10 CMA. Some document says Splunk Add-On for Checkpoint needs to be installed on Splunk itself. But some document says Log exporter also needs to be installed on R80.10 MDS. Please share your thoughts.

Thanks,

Arvind Singh

[Martin_Valenta]

Nothing is required, if you don't move from OPSec to LogExporter, you don't need to change anything.

[G_W_Albrecht]

• See sk108282: How to configure OPSEC LEA to talk to Splunk for all details.

[Dorit_Dor]

Why do you move to R80.10 now? In my view customers that move now should move to at least R80.20 (or even R80.30). 

The GW of R80.20 is dramatically better than the R80.10 (performance and scale as well as other i/s enhancements) and R80.30 is better if you use SSL. So i recommend GW upgrade to R80.20 and above and not to R80.10. 

Mgmt is less dramatic in difference but still in r80.10 there is special vsec private support and special hot fix for log exporter. All are fully built in R80.20 which is nearly one year in the market. Going directly to R80.20 is a safe step (btw we have more mgmt r80.20 at this point than R80.10 and than R70.30).