All Apps and Add-ons

No Dome input options after installing dome9

MikeBertelsen
Communicator

I installed the Splunk AWS app, add on and Dome9 app
Going through the configuration I am unable to select a dome type under data inputs.

0 Karma
1 Solution

amiracle
Splunk Employee
Splunk Employee

You should be able to type in dome9 in the filter and the sources will show up. I would recommend that you use the aws:dome9 source type then it shows up.

alt text

View solution in original post

0 Karma

amiracle
Splunk Employee
Splunk Employee

You should be able to type in dome9 in the filter and the sources will show up. I would recommend that you use the aws:dome9 source type then it shows up.

alt text

0 Karma

MikeBertelsen
Communicator

alt text

0 Karma

amiracle
Splunk Employee
Splunk Employee

Hello Mike,

Make sure that you are using the Dome9 App for Splunk : https://splunkbase.splunk.com/app/3203/ Once you setup the App, to collect the data you will need to follow these instructions : https://github.com/amiracle/splunk_app_dome9

The data from Dome9 will come through an SNS topic that can be sent to Splunk via a Lambda Function into the Splunk HTTP Event Collector (HEC).

Let me know if that helps you get your Dome9 data into Splunk.

0 Karma

MikeBertelsen
Communicator

I had done all that. Today I uninstalled the splunk_app_dome9, splunk_app_aws & Splunk_TA_aws.

Next reinstalled/configured splunk_app_aws and Splunk_TA_aws.
Reinstalled splunk_app_dome9.

Same results, there is no sourcetype aws:dome9 available to select when creating the new token.

0 Karma

amiracle
Splunk Employee
Splunk Employee

Did you try the source type aws-dome9 ?

0 Karma

MikeBertelsen
Communicator

I would but it is not available to select.

0 Karma

MikeBertelsen
Communicator

Ok. Got it now.
It was available after I enabled the global.
Then I was able to add the token.
Log into your Splunk instance and click on Settings -> Data Inputs -> HTTP Event Collector. Click on Create New Token. Name the input "Dome9 Input" then click Next.

Select the correct source type "aws:dome9", leave the Default Index as "Default." Click Review, then Submit.

Copy the Token Value and keep it ready.

Finally, enable the token by clicking on "Global Settings" and enable the tokens.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...