Skip to main content

Splunk

Visualize your Splunk deployment in JupiterOne: the Splunk instance itself, its indexes (size, retention, event range and whether each is enabled), and the forwarders that phone home to your deployment server, with their host, IP, build and the apps deployed to them. Monitor index retention and forwarder coverage through queries and alerts. A separate JupiterOne app for Splunk also lets you send JupiterOne alerts into Splunk; see the end of the installation guide.

Installation​

This integration reads your Splunk deployment through the Splunk REST API on the splunkd management port. It only sends GET requests and never changes your Splunk configuration. It doesn't read search results, events or audit data, and it doesn't touch Splunk Enterprise Security.

Prerequisites​

  • A Splunk Enterprise instance, or a Splunk Cloud Platform deployment with REST API access. Free trial Splunk Cloud Platform accounts can't access the REST API.
  • The management URL, including the scheme and port:
    • Splunk Enterprise: for example https://splunk.example.com:8089.
    • Splunk Cloud Platform: https://<deployment-name>.splunkcloud.com:8089. If port 8089 isn't open on your deployment yet, open a case with Splunk Support to enable it.
  • A Splunk user or authentication token with the capabilities below.
  • Access to JupiterOne with permission to configure integrations.
note

Splunk Enterprise instances usually sit inside a private network that the internet can't reach. In that case, run this integration through a JupiterOne Collector inside your network.

Configuration in Splunk​

Create a dedicated role for JupiterOne, and give a user or token that role:

  • list_settings: reads the instance details (server/info).
  • list_deployment_server: lists forwarders (deployment/server/clients). This is only needed if the instance is a deployment server.
  • indexes_list_all: lists indexes (data/indexes). This is only needed when indexes_list_all is enforced in authorize.conf, because by default every user can list indexes.

The integration supports two authentication methods. Pick one when you create the instance in JupiterOne.

  • Username and password: a local Splunk user with the role above.
  • Authentication token: recommended for Splunk Cloud Platform and for users who sign in with SSO. Token authentication must be enabled, and you create the token under Settings > Tokens for a user with the role above. See Create authentication tokens.
note

Splunk documents its introspection endpoints, which include server/info and data/indexes, as not applicable to Splunk Cloud Platform, and deployment server endpoints as generally not accessible there. Index and forwarder data may therefore be limited on Splunk Cloud Platform.

Configuration in JupiterOne​

To install the Splunk integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Splunk. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

  • The Account Name used to identify the Splunk account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.
  • Description to assist in identifying the integration instance, if desired.
  • Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.
  • The Splunk Management URL, for example https://splunk.example.com:8089.
  • The authentication method and its fields:
    • Authentication: the Username and Password.
    • API Token: the Authentication Token.
  • Optionally, a CA Certificate (PEM) when splunkd presents a self-signed or internal-CA certificate. Disable TLS Verification is also available, but it isn't recommended.

Click Create once all values are provided to finalize the integration.

Data sources​

Both data sources are off by default. Turn on the ones you want in the instance's ingestion source settings.

Ingestion sourceData collected
IndexesSplunk indexes, with type, current and maximum size, retention, oldest and newest event, and whether each is internal or enabled.
ForwardersDeployment clients that phone home to the deployment server, with hostname, DNS name, IP, machine type, build, server classes, deployed app names and last phone-home time.

The instance itself (splunk_account) is always collected.

Send JupiterOne alerts to Splunk​

This is a separate JupiterOne app for Splunk that works the other way around: it brings JupiterOne alert data into Splunk.

To send JupiterOne alerts to Splunk, you will first need to obtain your JupiterOne accountId and generate an API Key in JupiterOne:

  • Generate your API Key: Create your API Key by following instructions on our API Key Access guide.
  • Obtaining your JupiterOne accountId: Run this query within the JupiterOne search on the app's home view: find jupiterone_account. The results column will display the value within the accountId column.

Add JupiterOne to Splunk​

With both the API Key and accountId from JupiterOne, proceed to Splunk to add JupiterOne to your Splunk workspace. This can be done either by:

  1. Installing the JupiterOne app directly from the Splunk dashboard:

    1. On the Splunk home dashboard, use the Find More Apps link to find and install the JupiterOne Add-on and the JupiterOne app.

  2. Downloading the JupiterOne add-on and app package from the Splunkbase marketplace:

    1. In Splunk navigate to Apps > Manage Apps by clicking the gear icon in the upper-left corner.
    2. Select Install app from file in the top-right.
    3. Choose File and select the JupiterOne add-on package or app package.
    4. Click Upload and follow the prompts to complete the process.
Configure the JupiterOne Add-on in Splunk​

Now that JupiterOne has been added to Splunk, the last step is to finalize the configuration and input your JupiterOne credentials.

  1. In Splunk, navigate to the JupiterOne Add-on for Splunk, and click Configuration.
  2. Click Add to create a new JupiterOne account configuration on the add-on.
  3. Enter your JupiterOne Account Name, accountId, and API Key. Click Add when finished.
    • Optional: You can add a proxy under the Proxy tab, or change the log level on the Logging tab. By default the log level is INFO.
  4. Next, go to the Inputs tab, and choose Create New Input.
  5. Enter the desired values for the input, and press Add once done.

This concludes the setup for the Add-on. With the Add-on configured, the JupiterOne app within Splunk will start working without additional setup.

info

More details are available on the Splunkbase marketplace for the add-on and the App.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.

Additional resources​