-
Notifications
You must be signed in to change notification settings - Fork 10.1k
[Logs] Update Logpush to Splunk #23114
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -10,7 +10,7 @@ head: | |
|
|
||
| import { Render } from "~/components"; | ||
|
|
||
| Cloudflare Logpush supports pushing logs directly to Splunk via the Cloudflare dashboard or via API. | ||
| The [HTTP Event Collector (HEC)](https://dev.splunk.com/enterprise/docs/devtools/httpeventcollector/) is a reliable method to receive data from Splunk Enterprise or Splunk Cloud Platform. Cloudflare Logpush supports pushing logs directly to Splunk HEC via the Cloudflare dashboard or API. | ||
|
|
||
| ## Manage via the Cloudflare dashboard | ||
|
|
||
|
|
@@ -19,13 +19,13 @@ Cloudflare Logpush supports pushing logs directly to Splunk via the Cloudflare d | |
| 5. In **Select a destination**, choose **Splunk**. | ||
|
|
||
| 6. Enter or select the following destination information: | ||
| - **Splunk raw HTTP Event Collector URL** | ||
| - **Channel ID** - This is a random GUID that you can generate using [guidgenerator.com](http://guidgenerator.com/). | ||
| - **Auth Token** | ||
| - **Splunk HEC URL** | ||
| - **Channel ID** - This is a random GUID that you can generate using [guidgenerator.com](https://guidgenerator.com/). | ||
| - **Auth Token** - Event Collector token. | ||
| - **Source Type** - For example, `cloudflare:json`. If you are using the [Cloudflare App for Splunk](https://splunkbase.splunk.com/app/4501), refer to the appropriate source type for the corresponding datasets under the **Details** section. For instance, for Zero Trust Access requests logs, the source type is `cloudflare:access`. | ||
| - **Use insecure skip verify option** (not recommended). | ||
|
|
||
| When you are done entering the destination details, select **Continue**. | ||
| When you are done entering the destination details, click **Continue**. | ||
|
|
||
| 7. Select the dataset to push to the storage service. | ||
|
|
||
|
|
@@ -41,7 +41,7 @@ When you are done entering the destination details, select **Continue**. | |
| - Select a [sampling rate](/logs/get-started/api-configuration/#sampling-rate) for your logs or push a randomly-sampled percentage of logs. | ||
| - Enable redaction for `CVE-2021-44228`. This option will replace every occurrence of `${` with `x{`. | ||
|
|
||
| 10. Select **Submit** once you are done configuring your logpush job. | ||
| 10. Click **Submit** once you are done configuring your logpush job. | ||
angelampcosta marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
|
|
||
| ## Manage via API | ||
|
|
||
|
|
@@ -64,10 +64,10 @@ To create a job, make a `POST` request to the Logpush jobs endpoint with the fol | |
| - **destination_conf** - A log destination consisting of an endpoint URL, channel id, insecure-skip-verify flag, source type, authorization header in the string format below. | ||
|
|
||
| - **\<SPLUNK_ENDPOINT_URL>**: The Splunk raw HTTP Event Collector URL with port. For example: `splunk.cf-analytics.com:8088/services/collector/raw`. | ||
| - Cloudflare expects the HEC network port to be configured to `:443` or `:8088`. | ||
| - Currently, HEC network port has to be configured to either `443` or `8088`. | ||
|
||
| - Cloudflare expects the Splunk endpoint to be `/services/collector/raw` while configuring and setting up the Logpush job. | ||
| - Ensure you have enabled HEC in Splunk. Refer to [Splunk Analytics Integrations](/analytics/analytics-integrations/splunk/) for information on how to set up HEC in Splunk. | ||
| - You may notice an API request failed with a 504 error, when adding an incorrect URL. Splunk Cloud endpoint URL usually contains `http-inputs-` or similar text before the hostname. Refer to [Send data to HTTP Event Collector on Splunk Cloud Platform](https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector#Send_data_to_HTTP_Event_Collector) for more details. | ||
| - You may notice an API request failed with a 504 error, when adding an incorrect URL. Splunk Cloud endpoint URL usually contains `http-inputs-` or similar text before the hostname. | ||
| - **\<SPLUNK_CHANNEL_ID>**: A unique channel ID. This is a random GUID that you can generate by: | ||
| - Using an online tool like the [GUID generator](https://www.guidgenerator.com/). | ||
| - Using the command line. For example: `python -c 'import uuid; print(uuid.uuid4())'`. | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.