We as a Splunk admin, receive multiple onboarding requests. These can be from various data sources which may include API data or any cloud data.
As we are aware that these days we are multiple customers are interested to see Google cloud-based data and metrics into Splunk so it is good for us to understand the process for the same. The Splunk Add-on for Google Cloud Platform allows a Splunk administrator to collect Google Cloud Platform events, logs, and performance metrics data using Google Cloud Platform APIs.
We can categorize the process in the below steps so that it can be easy for all team members to follow. Basically there are two phases to on-board the logs :
Let’s start the way of implementing this. Currently, we can only create three kinds of inputs for this add-on.
Here we are going to see the method for onboarding of Google Cloud Pub/Sub to Splunk using the add-on.
Because this add-on runs on the Splunk platform, all of the system requirements apply to the Splunk software used by the customer.
This add-on requires heavy forwarders to perform data collection via modular inputs and to perform the setup and authentication with Google Cloud Platform.
Configure credentials of the Splunk Add-on for Google Cloud Platform by completing the following steps:
google_credentials.confusing the following template
google_credentials = <This is a Key provided by user># Google service account key that is in json format and can be downloaded from Google admin console
Follow these steps to configure Cloud Pub/Sub inputs.
google_credentials_name = <value> #Stanza name defined in `google_credentials.conf` (Make sure it is derived from credential name)
google_project = <value> #This will be given by user (Please note that Project is mandatory in order to create any input, else there will be error for EXEC PROCESSOR which is via modular input.)
google_subscriptions = <value> #This will be given by user (Please note that Subscription must be associated with Project)
index = <google_cloud_staging> #This is a separate index for indexing google cloud data.
Now it is time to setup up account for google cloud with service account and valid keys associated with it.
By using above method team can simply onboard the inputs for Google Cloud addon data for Pub/Sub inputs. Kindly reach us to know if in case anyone has any questions with the same.
Happy Splunking !!