Skip to main content

Splunk

Build an inventory of the devices known to Splunk in JupiterOne: every host that sends data to your indexes, with when it was first and last seen and what kind of data it sends, and the forwarders connecting to your indexers, with their OS, IP, version and the host they run on. The Splunk instance itself and its indexes (size, retention, event range and whether each is enabled) are collected too. Find devices that stopped sending logs, or that have no forwarder, through queries and alerts. A separate JupiterOne app for Splunk also lets you send JupiterOne alerts into Splunk; see the end of the installation guide.

Installation​

This integration builds an inventory of the devices known to Splunk through the Splunk REST API on the splunkd management port. It runs two read-only summary searches as search jobs: one lists the hosts that sent data to your indexes, and one lists the forwarders connecting to your indexers. It cancels each search job once it has read the results. It never reads raw events or audit data, never changes your Splunk configuration, and doesn't touch Splunk Enterprise Security.

Prerequisites​

  • A Splunk Enterprise instance, or a Splunk Cloud Platform deployment with REST API access. Free trial Splunk Cloud Platform accounts can't access the REST API.
  • The management URL, including the scheme and port:
    • Splunk Enterprise: for example https://splunk.example.com:8089.
    • Splunk Cloud Platform: https://<deployment-name>.splunkcloud.com:8089. If port 8089 isn't open on your deployment yet, open a case with Splunk Support to enable it.
  • A Splunk user or authentication token with the capabilities below.
  • Access to JupiterOne with permission to configure integrations.
note

Splunk Enterprise instances usually sit inside a private network that the internet can't reach. In that case, run this integration through a JupiterOne Collector inside your network.

Configuration in Splunk​

Create a dedicated role for JupiterOne, and give a user or token that role:

  • search: runs the hosts and forwarders searches (search/v2/jobs).
  • Searchable indexes (srchIndexesAllowed): every index that holds data from the devices you want in the inventory, plus _internal, which holds the forwarder connection metrics. Hosts only appear from indexes the role can search.
  • list_settings: reads the instance details (server/info).
  • list_deployment_server: adds server classes, deployed apps and phone-home times to forwarders (deployment/server/clients). This is only needed if the instance is a deployment server.
  • indexes_list_all: lists indexes (data/indexes). This is only needed when indexes_list_all is enforced in authorize.conf, because by default every user can list indexes.

Give the role a modest search job quota so the integration's searches don't compete with your analysts.

The integration supports two authentication methods. Pick one when you create the instance in JupiterOne.

  • Username and password: a local Splunk user with the role above.
  • Authentication token: recommended for Splunk Cloud Platform and for users who sign in with SSO. Token authentication must be enabled, and you create the token under Settings > Tokens for a user with the role above. See Create authentication tokens.
note

On Splunk Cloud Platform, point the integration at your search head. The hosts and forwarders searches work there. Splunk documents its introspection endpoints, which include server/info and data/indexes, as not applicable to Splunk Cloud Platform, and deployment server endpoints as generally not accessible there, so index data and forwarder deployment details may be limited.

Configuration in JupiterOne​

To install the Splunk integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Splunk. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

  • The Account Name used to identify the Splunk account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.
  • Description to assist in identifying the integration instance, if desired.
  • Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.
  • The Splunk Management URL, for example https://splunk.example.com:8089.
  • The authentication method and its fields:
    • Authentication: the Username and Password.
    • API Token: the Authentication Token.
  • Optionally, a CA Certificate (PEM) when splunkd presents a self-signed or internal-CA certificate. Disable TLS Verification is also available, but it isn't recommended.
  • Optionally, the Host Lookback (days) (default 30): hosts with no events in this window aren't ingested.
  • Optionally, the Forwarder Lookback (days) (default 7): forwarders that haven't connected in this window aren't ingested.

Click Create once all values are provided to finalize the integration.

Data sources​

All data sources are on by default. You can turn any of them off in the instance's ingestion source settings.

Ingestion sourceData collected
HostsOne device for each host that sent data to the indexes the role can search within the lookback window, with first and last seen times, event count, indexes and sourcetypes. Hosts that run a forwarder also get OS, IP, architecture and forwarder type and version.
ForwardersForwarders that connected to your indexers within the lookback window, from the connection metrics in _internal, with hostname, IP, OS, architecture, version, forwarder type and receiving indexers. When the instance is a deployment server, they also get DNS name, server classes, deployed app names and last phone-home time. Each forwarder is linked to the host it runs on.
IndexesSplunk indexes, with type, current and maximum size, retention, oldest and newest event, and whether each is internal or enabled.

When you run the integration container yourself instead of through JupiterOne, it doesn't read these settings and runs every data source. To turn some off, set the DISABLED_INGESTION_SOURCES environment variable to a comma-separated list of hosts, forwarders and indexes.

The instance itself (splunk_account) is always collected.

Send JupiterOne alerts to Splunk​

This is a separate JupiterOne app for Splunk that works the other way around: it brings JupiterOne alert data into Splunk.

To send JupiterOne alerts to Splunk, you will first need to obtain your JupiterOne accountId and generate an API Key in JupiterOne:

  • Generate your API Key: Create your API Key by following instructions on our API Key Access guide.
  • Obtaining your JupiterOne accountId: Run this query within the JupiterOne search on the app's home view: find jupiterone_account. The results column will display the value within the accountId column.

Add JupiterOne to Splunk​

With both the API Key and accountId from JupiterOne, proceed to Splunk to add JupiterOne to your Splunk workspace. This can be done either by:

  1. Installing the JupiterOne app directly from the Splunk dashboard:

    1. On the Splunk home dashboard, use the Find More Apps link to find and install the JupiterOne Add-on and the JupiterOne app.

  2. Downloading the JupiterOne add-on and app package from the Splunkbase marketplace:

    1. In Splunk navigate to Apps > Manage Apps by clicking the gear icon in the upper-left corner.
    2. Select Install app from file in the top-right.
    3. Choose File and select the JupiterOne add-on package or app package.
    4. Click Upload and follow the prompts to complete the process.
Configure the JupiterOne Add-on in Splunk​

Now that JupiterOne has been added to Splunk, the last step is to finalize the configuration and input your JupiterOne credentials.

  1. In Splunk, navigate to the JupiterOne Add-on for Splunk, and click Configuration.
  2. Click Add to create a new JupiterOne account configuration on the add-on.
  3. Enter your JupiterOne Account Name, accountId, and API Key. Click Add when finished.
    • Optional: You can add a proxy under the Proxy tab, or change the log level on the Logging tab. By default the log level is INFO.
  4. Next, go to the Inputs tab, and choose Create New Input.
  5. Enter the desired values for the input, and press Add once done.

This concludes the setup for the Add-on. With the Add-on configured, the JupiterOne app within Splunk will start working without additional setup.

info

More details are available on the Splunkbase marketplace for the add-on and the App.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.

Additional resources​