This guide covers the deployment, configuration and usage of the CrowdStrike Scheduled Search Technical Add-on (TA) for Splunk v2.2.0 and above. The CrowdStrike Scheduled Search Technical Add-on for Splunk allows CrowdStrike customers to retrieve successful Scheduled Search event data from CrowdStrike APIs and index it into Splunk.

For deploying and configuring the CrowdStrike Scheduled Search Splunk Technical Add-On located on Splunkbase: https://splunkbase.splunk.com/app/6902