Installing QRadar App for Splunk Data Forwarding
Use the QRadar® Extensions Management tool to install the app on your QRadar Console.
Before you begin
Before you install the app, ensure that IBM® QRadar App for Splunk Data Forwarding meets the minimum memory (RAM) requirements. QRadar App for Splunk Data Forwarding requires 200 MB of free memory from the application pool of memory. If QRadar App for Splunk Data Forwarding fails to install, then your application pool does not have enough free memory to run the app. Consider adding an App Node or an App Host to your QRadar deployment. For more information on calculating the required memory, see Apps and Resource Limitation (https://ibm.com/support/pages/qradar-apps-and-resource-limitation).
About this task
You can use the IBM QRadar Extensions Management tool to install the app on your QRadar Console.
- If the IBM QRadar Assistant app is configured on QRadar, use the following instructions to install QRadar App for Splunk Data Forwarding: QRadar Assistant app (https://www.ibm.com/docs/en/qsip/7.5?topic=apps-qradar-assistant-app).
- If the QRadar Assistant app is not configured, download QRadar App for Splunk Data Forwarding archive from the IBM Security App Exchange (https://apps.xforce.ibmcloud.com/) onto your local computer. You must have an IBM ID to access the App Exchange.
- In the System Configuration section, click Extensions Management.
- In the Extensions Management window, click Add and select the app archive that you want to upload to the console.
Select the Install immediately check box.
Important: You might have to wait several minutes before your app becomes active.