About apietsch

apietsch

Agent-based: Use the Splunk OpenTelemetry Collector ( link ) or the Splunk UniversalForwarder ( link ) Agent-less: Use the Splunk Add-On for AWS ( link ) it calls the AWS REST API.

apietsch

Interesting... Is it a different result every time you run it or at least the same different results for the same input?

apietsch

According to the documentation for search time modifiers you should be correct. Although example 4 and 5 on that page uses a different time format. Try the format from the examples.

apietsch

Hi, you can easily see the usage data in the Management Console. There are searches behind the panels (little search icon in the lower right of each panel). The data for the searches is in your Splunk Environment. You can now take and modify those searches to time bucket by hour and/or month. It would make sense to save this search as a report, let the report run regularly (scheduled) and use a summary index for the results. After that you can use the REST API on your Splunk SearchHead to trigger a search against the summarised data and get the results as a csv or json. I can't give you a specific search cause that depends on your license model and Splunk version. But the panels in the Management Console Dashboards give you the searches you need to start from.

apietsch

The timechart command neeeeeeeeeeeeeds a _time field for the time bucketing. With your stats command you have not done a "by _time" and with that ignored / "eliminated" the _time field from the results. That means the field is no longer available for any command after the stats line. You would have to at least add the _time field to the by clause of the stats command. With that said... I think your "append" with the inputlookup would create results where there is no "_time" field at the end of the resultset. So it will be funny to see what stats does with those results. My recommendation is to either try to just do the lookup without the append or eval some _time field with a value that makes sense to the inputlookup append.

apietsch

If you want to monitor your SaaS application from the outside, there are also mechanisms in the observability components (like Real User Monitoring, Synthetic Monitoring, ...) available.

apietsch

That helps. You can surely look on https://splunkbase.splunk.com if there is an add-on for your SaaS application. Usually you get the technical mechanisms in an add-on and the visual knowledge objects like dashboards in an app. But sometimes it's a combination. Please refer to the documentation of the app/add-on to see what it is capable of. If there is one, you would see that you get that into your Splunk environment. Either Splunk cloud or Splunk Enterprise. The add-on should be vetted for your instance and version. After that you follow the instructions of the app/add-on to onboard the data. If there is nothing available in splunkbase you would start from scratch. For that the add-on builder is a good start. You would create the mechanism to get the data from the SaaS REST API, extract the fields and create dashboards after that. That's the usual process.

apietsch

Wow... what a broad question. 🙂 What do you mean by integrate? Which direction? Generally you can call REST endpoints and consume whatever comes out, you can also send data there. If you get data pushed you would have to set up a point (machine) where you can receive the data, process it and forward it to Splunk or use a HEC (HTTP Event Collector) endpoint of a Splunk instance. If the SaaS produces machine readable files, you would be able to consume those as well. So you see that there are various ways.

apietsch

Just collecting the logs is a great start. If you want to collect technical metrics about user interaction you can use the RUM integration as well. And depending what your backend looks like you could use the opensource OpenTelemetry libraries to instrument your backend application that processes your web application data. There is even a free and opensource Splunk distribution of OpenTelemetry (including the collector) available.

Posts	10
Solutions	2
Karma Given	0
Karma Received	1
Member Since	‎11-23-2020

Online Status	Offline
Date Last Visited	2 weeks ago

Re: agentless and agent based onboarding

Re: incorrect use of eval?

Re: Splunk search earliest and latest in Splunk s...

Re: How to get splunk billing usage data hourly an...

Re: Timechart based off of a search and an appende...

Re: 3rd party SaaS applications with Splunk.

Re: 3rd party SaaS applications with Splunk.

Re: 3rd party SaaS applications with Splunk.

Re: Splunk Integration