Splunk
-
Create a restricted Splunk API user's role from the Splunk Web UI
- `Settings` -> `Roles` -> `New Role`
- Name: any, such as `graphistry_role`
- For `capabilities`: `rest_properties get`, `rtsearch`, `search`
- For `indexes`: Any that you want exposed to the investigtation team
- Create a restricted Splunk API user from the Splunk Web UI
- `Settings` -> `Users` -> `New User`
- Record their name/pwd
- Assign them to the role `graphistry_user` from step 1
- Configure Graphistry's `custom.env` with the Splunk server and user information:
### Required SPLUNK_HOST=splunk.acme.org SPLUNK_USER=admin SPLUNK_KEY=... ### Optional #SPLUNK_SCHEME=https #SPLUNK_PORT=8089 #SPLUNK_WEB_PORT=443 #SPLUNK_SUFFIX=/en-US #SPLUNK_CACHE_TIMEOUT=14400 #SPLUNK_SEARCH_MAX_TIME=20 -
Restart and test the connector as per above. You can test the underlying Splunk API configuration by running from your local Splunk server and your Graphistry server:
curl -u admin:changme https://splunk.host.name.here:8089/services/search/jobs/export -d search="search * | head 3" -d output_mode=csv