Integrations/splunk/splunk.splunk pimB

This page documents the enPortal integration for Splunk.

• Vendor: Splunk
• Product: Splunk
• Supported Version(s): 4.3.4
• Name of enPortal Integration Package: splunk.splunk_pimB
• Required enPortal Version: 4.6.1 and above

The following section documents supported platforms, installation, and configuration of the Splunk Product Integration Module on enPortal versions 5.0 and above.

Support Matrix

The following Operating System, Database, and Web Browser platforms are supported:

Operating System

Please see the list of supported Operating Systems on the System Requirements page.

Database

A special database is not required to implement this integration module. The AppBoard/enPortal database is used to store all configurations related to this integration module.

Web Browser

Please see the list of supported Web Browsers on the System Requirements page.

Installation

Perform the following steps to install the Splunk PIM:

1. Install AppBoard/enPortal as detailed in the Installation documentation
2. Download the file splunk.splunk_pimB.jar
3. Start enPortal and login as an administrator
   1. User Name: administrator
   2. Password: administrator
   3. Domain: System
4. Under the Advanced tab, select PIMImport
5. Click the Browse... button
6. Locate the Splunk package.jar file in the Open dialog
7. Click the Start button to extract the files from the PIM .jar archive
8. Under the Advanced tab, select XMLImport
9. Click the Start button to load the PIM into the system
10. Confirm that the following message is displayed: "Import completed; loaded the following file(s): load_splunk.splunk_pimB.txt"
11. Under the Advanced tab, select Explore System
12. Navigate to the /Directory/system/proxy/ folder and locate the “Manage Proxy” channel
13. Right-click on the “Manage Proxy” channel and select Open to launch the channel
14. In the Manage Proxy tool, click “Reset All”
15. Refresh the browser

Integration Details

This sections provides special details for configuring the integration module after installation.

Channel Types

• Application - The main entrance points of Splunk, "gettingstarted" and "search".
• Search Application - The search application functions. They are SplunkTest, charting, dashboard_live, flashtimeline, index_status, index_status_health, indexing_volume, inputs_status, pdf_activity, scheduler_savedsearch, scheduler_status, scheduler_status_errors, scheduler_user_app, search_detail_activity, search_status, search_ui_activity, search_user_activity, splunkd_status, splunkweb_status
• Home - Channel that displays the top-level Home page of the Splunk application
• Proxy - Channel that is used by the system to display Splunk channels

Configuration

After installing the Splunk PIM, perform the following steps to configure access to the host Splunk server:

1. Click on the Applications tab
2. Right-click on the name "sample" in the row for splunk.splunk_pimB and select "Modify"
3. Fill in the items in the Modify Application Wizard dialog:
   1. Select the protocol used to access your Splunk server (http or https)
   2. Change the host name from "changeme" to the hostname or ip address that will resolve to your Splunk server
   3. Change the port to the port number of your Splunk server
   4. Click "Save" to keep your changes
4. Click on the Integrations tab
5. In the Explorer, under Packages, expand the splunk.splunk_pimB tree and click on the Sample target. Confirm that the information you entered is displayed for your Splunk server
6. Under the Sample target, click on the Home channel. A login prompt should be displayed.
7. Log in using the same credentials you would use for accessing the Splunk application in a browser. Confirm that the Splunk Home page is displayed.

Create Channels

After installing the Splunk PIM and configuring access to the host Splunk server, perform the following steps to create channels to display Splunk content:

1. Click on the Applications tab
2. Right-click on the name "sample" in the row for splunk.splunk_pimB and select a channel type
3. In the "Channel Name" box, enter the name you want to give to the new channel
4. For "Channel Type", select "3rd Party Pims"
5. Click Next
6. Click Finish
7. Click on the Integrations tab
8. In the Explorer, under Packages, expand the splunk.splunk_pimB tree and click on the Sample target. Confirm that the new channel is listed along with the other sample channels

Repeat the above steps to create additional channels. Select a different Channel Type in step 2 to create a different type of channel.

Splunk Upgrades

Upgrading from an older version of Splunk to Version 4.3.4

Older versions of Splunk are not supported by this PIM, so this upgrade path is not supported.

Upgrading Splunk from Version 4.3.4 to a newer version

Perform the following steps when the Splunk server is upgraded to a newer version of Splunk:

1. Check the AppBoard/enPortal PIM online documentation to see if the new Splunk version is supported by the existing splunk.splunk_pimB PIM.
   1. To test if the new Splunk version is supported by the existing PIM that you have installed, perform the following steps:
      1. Click on the Applications tab
      2. Right-click on the row for the old Splunk server and select "Modify"
      3. Update the protocol, host, and port to reference the server where the new version of Splunk is running
   2. If the new Splunk version is not supported by the existing PIM that you have installed, perform the following steps to upgrade the PIM:
      1. Download the new PIM version from the PIM download site
      2. Follow the steps in the Installation section above to install and configure the new PIM version
      3. Re-create all Splunk channels to reference the new PIM
      4. [Optional] Perform the steps outlined in the Uninstall section below to remove the old PIM from the system

Uninstall

Uninstalling the splunk.splunk_pimB PIM will break all of the channels in your AppBoard/enPortal system that reference this integration.

Perform the following steps to uninstall the splunk.splunk_pimB PIM:

1. Click on the Integrations tab
2. In the Explorer, under Packages, locate the splunk.splunk_pimB integration
3. Right click on the integration name, and select "Delete"
4. Click "Ok" to confirm that you want to delete the integration package