Splunk Integration Guide
Review the following guide for setting up an integration between Litmus Edge and Splunk through HTTP.
Before You Begin
You must have a Splunk account.
Step 1: Add Device
Follow the steps to Connect a Device. The device will be used to store tags that will be eventually used to create outbound topics in the connector. Make sure to select the Enable Data Store checkbox.
Step 2: Add Tag
After connecting the device in Litmus Edge, you can Add Tags to the device. Create tags that you want to use to create outbound topics for the connector.
Step 3: Retrieve Splunk Parameters
Log in to Splunk, navigate to the Splunk - Sublime Text page, and copy the following values:
- Input line
- Services line
- Token line
Step 4: Add the Splunk Connector
Follow the steps to Add a Connector and select the Splunk provider.
Configure the following parameters.
- Name: Enter a name for the connector.
- Hostname: Paste the Input line copied in Step 3.
- Port: Leave the default value of 8088.
- Use SSL: Make sure the check box is selected.
- Endpoint: Paste the Services line copied in Step 3.
- Token: Paste the Token line copied in Step 3.
- Throttling Limit: The maximum number of messages per second to be processed. The default value is zero, which means that there is no limit.
- Persistent storage: When enabled, this will cause messages to undergo a store-and-forward procedure. Messages will be stored within Litmus Edge when cloud providers are online.
- Queue Mode: Select the queue mode as lifo (last in first out) or fifo (first in first out). Selecting lifo means that the last data entry is processed first, and selecting fifo means the first data entry is processed first.
Step 5: Enable the Connector
After adding the connector, click the toggle in the connector tile to enable it.
If you see a Failed status, you can review the Connector Logs and relevant error messages.
Step 6: Create Topics for Connector
You will now need to import the tags created in Step 2 as topics for the Splunk connector. The topic will be created as outbound topics.
To create outbound topics:
- Click the connector tile. The connector Dashboard appears.
- Click the Topics tab.
- Click the Import from DeviceHub tags icon. The DeviceHub Import dialog box appears.
After adding all required topics, navigate to the Integration overview page and ensure the connector is not disabled and still shows a CONNECTED status.
Step 7: Enable Topics
To enable the topic, return to the Topics tab and click the Enable all topics icon.
Step 8: Verify Data Connection in Splunk
To verify the data connection in Splunk:
- Log in to Splunk.
- Open the Splunk HTTP Event Collector and refresh the data.
- Scroll down to the Activity section and hover over the data to view Valid Requests.
- In the Request Overview section, hover over the Valid Request Count and click the Refresh icon.
- Verify that the values for Event Count and Valid Request Count update.