You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/analytics/analytics-integrations/splunk.mdx
+1-4Lines changed: 1 addition & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ title: Splunk
4
4
sidebar:
5
5
order: 104
6
6
description: >-
7
-
This tutorial explains how to analyze [Cloudflare Logs] using the Cloudflare App for Splunk. Prerequisites: Have an existing Splunk Enterprise or Cloud account. Consult the [Splunk documentation] for more information.
7
+
This tutorial explains how to analyze Cloudflare Logs using the Cloudflare App for Splunk.
8
8
---
9
9
10
10
import { Render } from"~/components";
@@ -32,20 +32,17 @@ To install the [Cloudflare App for Splunk](https://splunkbase.splunk.com/app/450
32
32
4. Restart and reopen your Splunk instance.
33
33
34
34
5. Edit the `cloudflare:json` source type in the Cloudflare App for Splunk. To edit the source type:
35
-
36
35
1. Click the **Settings** dropdown and select **Source types**.
37
36
2. Uncheck **Show only popular** and search for _cloudflare_.
38
37
3. Click **Edit** and change the Regex expression to `([\r\n]+)`.
39
38
4. Save your edits.
40
39
41
40
6. Create an index on Splunk to store the HTTP Event logs. To create an index:
42
-
43
41
1. Open the setup screen by clicking the **Settings** dropdown, then click **Indexes**.
44
42
2. Select **New Index**. Note that the **Indexes** page also gives you the status of all your existing indexes so that you can see whether you're about to use up your licensed amount of space.
45
43
3. Name the index **cloudflare**, which is the default index that the Cloudflare App will use.
46
44
47
45
7. Set up the HTTP Event Collector (HEC) on Splunk. To create an HEC:
48
-
49
46
1. Click the **Settings** dropdown and select **Data inputs**.
50
47
2. Click **+Add new** and follow the wizard. When prompted, submit the following responses:
0 commit comments