Upgrading Kaspersky CyberTrace integration (Splunk)

This section describes how to finish the integration of Kaspersky CyberTrace with Splunk after upgrading Kaspersky CyberTrace.

When upgrading the integration of Kaspersky CyberTrace with Splunk to the latest version, import the new version of Kaspersky CyberTrace App for Splunk to Splunk. During the import, select the option shown in the picture below.

Upgrading integration with Splunk

The application settings will be reset. The old settings will be saved in %SPLUNK_DIRECTORY%/etc/apps/Kaspersky-CyberTrace-App-for-Splunk/default.old.%CURRENT_DATE%, where %CURRENT_DATE% can be in the format yyyymmdd-hhmmss (for example, 20190725-161423). Kaspersky CyberTrace App for Splunk must be configured in its entirety, similar to the way in which the old version was configured.