Skip to content

Commit 2bf79d6

Browse files
jerewill-ciscojerewill-cisco
committed
more documentation
1 parent 31c00a0 commit 2bf79d6

File tree

4 files changed

+83
-12
lines changed

4 files changed

+83
-12
lines changed

‎README.md‎

Lines changed: 18 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
1-
# Intersight Add-on for Splunk
1+
# Cisco Intersight Add-on for Splunk
22

3-
This project came about to fill a gap that I saw in the [Intersight](https://intersight.com/help/saas) ecosystem. How can you get useful data from Intersight into Splunk? Since Intersight uses a unique API authentication scheme, simple REST API inputs could not be used.
3+
This project came about to fill a gap that I saw in the [Cisco Intersight](https://intersight.com/help/saas) ecosystem. How can you get useful data from Intersight into Splunk? Since Intersight uses a unique API authentication scheme, simple REST API inputs could not be used.
44

55
This Splunk [Add-On](https://docs.splunk.com/Splexicon:Addon) begins to solve this problem by providing inputs for a number of Intersight data types.
66

7+
This Add-on is not supported by Cisco Systems or the Cisco Technical Assistance Center (TAC). It was developed by me, as a member of the community.
8+
79
## Development Overview
810

911
I used the [Splunk Add-on Builder](https://splunkbase.splunk.com/app/2962/) to create this Add-on. This approach provides a solid framework to build a python-based [scripted input](https://docs.splunk.com/Splexicon:Scriptedinput).
@@ -14,11 +16,15 @@ From here, the bulk of the work is contained in [input_module_intersight.py](inp
1416

1517
## Distribution
1618

17-
This add-on is available from Splunkbase at [future URL].
19+
This Add-on is available from Splunkbase at [future URL].
20+
21+
Please review [the release notes](splunkbase/releasenotes.md).
1822

1923
## Deployment
2024

21-
This Add-on will need an API key from Intersight. For now, only v2 API keys will work. Hopefully an update to intersight-auth will allow me to enable v3 keys in the future. Remember that when you create an API key, it will provide access as the currently logged-in user in the current role. You probably don't want to give Splunk an Account Administrator role API key.
25+
Typically, this Add-on would be installed on an indexer in your Splunk architecture.
26+
27+
The Add-on will need an API key from Intersight. For now, only v2 API keys will work. Hopefully an update to intersight-auth will allow me to enable v3 keys in the future. Remember that when you create an API key, it will provide access as the currently logged-in user in the current role. You probably don't want to give Splunk an Account Administrator role API key.
2228

2329
![Generate an API Key](images/generate_api_key.png)
2430

@@ -174,11 +180,11 @@ The default logging level here will be `info` but additional detail can be enabl
174180

175181
[See Issues on Github](https://github.com/jerewill-cisco/intersight-splunk-addon/issues/)
176182

177-
[1]: https://intersight.com/apidocs/apirefs/api/v1/aaa/AuditRecords/get/
178-
[2]: https://intersight.com/apidocs/apirefs/api/v1/cond/Alarms/get/
179-
[3]: https://intersight.com/apidocs/apirefs/api/v1/tam/AdvisoryInstances/get/
180-
[4]: https://intersight.com/apidocs/apirefs/api/v1/compute/PhysicalSummaries/get/
181-
[5]: https://intersight.com/apidocs/apirefs/api/v1/hyperflex/Clusters/get/
182-
[6]: https://intersight.com/apidocs/apirefs/api/v1/network/ElementSummaries/get/
183-
[7]: https://intersight.com/apidocs/apirefs/api/v1/asset/Targets/get/
184-
[8]: https://intersight.com/apidocs/apirefs/api/v1/hyperflex/Nodes/get/
183+
[1]: https://intersight.com/apidocs/apirefs/api/v1/aaa/AuditRecords/model/
184+
[2]: https://intersight.com/apidocs/apirefs/api/v1/cond/Alarms/model/
185+
[3]: https://intersight.com/apidocs/apirefs/api/v1/tam/AdvisoryInstances/model/
186+
[4]: https://intersight.com/apidocs/apirefs/api/v1/compute/PhysicalSummaries/model/
187+
[5]: https://intersight.com/apidocs/apirefs/api/v1/hyperflex/Clusters/model/
188+
[6]: https://intersight.com/apidocs/apirefs/api/v1/network/ElementSummaries/model/
189+
[7]: https://intersight.com/apidocs/apirefs/api/v1/asset/Targets/model/
190+
[8]: https://intersight.com/apidocs/apirefs/api/v1/hyperflex/Nodes/model/

‎splunkbase/introduction.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Cisco Intersight Add-on for Splunk
2+
3+
The Cisco Intersight Add-on for Splunk (TA-intersight-addon) provides a python-based scripted input to retrieve data from Cisco Intersight. SaaS, Connected Virtual Appliance, and Private Virtual Appliance deployments of Intersight are all supported.
4+
5+
The Add-on leverages the [Cisco Intersight RESTful API](https://intersight.com/apidocs/introduction/overview/) to retrieve various kinds of data. Multiple inputs for different Intersight accounts/appliances are configurable and each account/appliance can optionally retrieve the following data types. Events are in JSON format.
6+
7+
| Options | Intersight API | Splunk sourcetype |
8+
| --- | --- | --- |
9+
| AAA Audit Records | [aaa/AuditRecords][1] | cisco:intersight:aaaAuditRecords |
10+
| Alarms | [cond/Alarms][2] | cisco:intersight:condAlarms |
11+
| Advisories | [tam/AdvisoryInstances][3] | cisco:intersight:tamAdvisoryInstances |
12+
| Compute Inventory | [compute/PhysicalSummaries][4] | cisco:intersight:computePhysicalSummaries |
13+
| HX Cluster Inventory | [hyperflex/Clusters][5] | cisco:intersight:hyperflexClusters |
14+
| HX Cluster Inventory | [hyperflex/Nodes][8] | cisco:intersight:hyperflexNodes |
15+
| Network Inventory | [network/ElementSummaries][6] | cisco:intersight:networkElementSummaries |
16+
| Target Inventory | [asset/Targets][7] | cisco:intersight:assetTargets |
17+
18+
[1]: https://intersight.com/apidocs/apirefs/api/v1/aaa/AuditRecords/model/
19+
[2]: https://intersight.com/apidocs/apirefs/api/v1/cond/Alarms/model/
20+
[3]: https://intersight.com/apidocs/apirefs/api/v1/tam/AdvisoryInstances/model/
21+
[4]: https://intersight.com/apidocs/apirefs/api/v1/compute/PhysicalSummaries/model/
22+
[5]: https://intersight.com/apidocs/apirefs/api/v1/hyperflex/Clusters/model/
23+
[6]: https://intersight.com/apidocs/apirefs/api/v1/network/ElementSummaries/model/
24+
[7]: https://intersight.com/apidocs/apirefs/api/v1/asset/Targets/model/
25+
[8]: https://intersight.com/apidocs/apirefs/api/v1/hyperflex/Nodes/model/
26+
27+
Further documentation, sample searches, and known issues are all available at [the Github repository](https://github.com/jerewill-cisco/intersight-splunk-addon).
28+
29+
---
30+
This Add-on is community developed and is not supported by Cisco Systems or the Cisco Technical Assistance Center (TAC).

‎splunkbase/overview.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Cisco Intersight Add-on for Splunk
2+
3+
The Cisco Intersight Add-on for Splunk (TA-intersight-addon) provides a python-based scripted input to retrieve data from Cisco Intersight. SaaS, Connected Virtual Appliance, and Private Virtual Appliance deployments of Intersight are all supported.
4+
5+
The Add-on leverages the [Cisco Intersight RESTful API](https://intersight.com/apidocs/introduction/overview/) to retrieve various kinds of data. Multiple inputs for different Intersight accounts/appliances are configurable and each account/appliance can optionally retrieve the following data types. Events are in JSON format.
6+
7+
| Options | Intersight API | Splunk sourcetype |
8+
| --- | --- | --- |
9+
| AAA Audit Records | [aaa/AuditRecords][1] | cisco:intersight:aaaAuditRecords |
10+
| Alarms | [cond/Alarms][2] | cisco:intersight:condAlarms |
11+
| Advisories | [tam/AdvisoryInstances][3] | cisco:intersight:tamAdvisoryInstances |
12+
| Compute Inventory | [compute/PhysicalSummaries][4] | cisco:intersight:computePhysicalSummaries |
13+
| HX Cluster Inventory | [hyperflex/Clusters][5] | cisco:intersight:hyperflexClusters |
14+
| HX Cluster Inventory | [hyperflex/Nodes][8] | cisco:intersight:hyperflexNodes |
15+
| Network Inventory | [network/ElementSummaries][6] | cisco:intersight:networkElementSummaries |
16+
| Target Inventory | [asset/Targets][7] | cisco:intersight:assetTargets |
17+
18+
[1]: https://intersight.com/apidocs/apirefs/api/v1/aaa/AuditRecords/model/
19+
[2]: https://intersight.com/apidocs/apirefs/api/v1/cond/Alarms/model/
20+
[3]: https://intersight.com/apidocs/apirefs/api/v1/tam/AdvisoryInstances/model/
21+
[4]: https://intersight.com/apidocs/apirefs/api/v1/compute/PhysicalSummaries/model/
22+
[5]: https://intersight.com/apidocs/apirefs/api/v1/hyperflex/Clusters/model/
23+
[6]: https://intersight.com/apidocs/apirefs/api/v1/network/ElementSummaries/model/
24+
[7]: https://intersight.com/apidocs/apirefs/api/v1/asset/Targets/model/
25+
[8]: https://intersight.com/apidocs/apirefs/api/v1/hyperflex/Nodes/model/
26+
27+
Further documentation, sample searches, and known issues are all available at [the Github repository](https://github.com/jerewill-cisco/intersight-splunk-addon).
28+
29+
---
30+
This Add-on is community developed and is not suported by Cisco Systems or the Cisco Technical Assistance Center (TAC).

‎splunkbase/releasenotes.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Cisco Intersight Add-on for Splunk Release Notes
2+
3+
## 1.1.0
4+
5+
- Initial public release

0 commit comments

Comments
 (0)