Configure a Splunk integration

The Red Hat Insights (Red Hat Lightspeed) application for Splunk forwards selected Hybrid Cloud Console events to Splunk.

The application seamlessly integrates with the Hybrid Cloud Console, so that you can focus on handling the data on the Splunk application side in the same way that you manage other sources of data. After the integration has been configured, you can view and manage Hybrid Cloud Console notifications from the Splunk dashboard without having to open the Red Hat Hybrid Cloud Console.

If you have any issues with the Red Hat Insights application for Splunk, contact Red Hat for support. To open a Red Hat support case directly from the Hybrid Cloud Console:

  1. Click Help (the ? icon) to open the help panel.
  2. Select the My support cases tab.
  3. Click Open a support case and add information about the issue.

Splunk will not provide troubleshooting. The Red Hat Insights application for Splunk is fully supported by Red Hat.

Install the Red Hat Lightspeed application for Splunk
Copy link

Install and configure the Red Hat Insights (Red Hat Lightspeed) application for Splunk to integrate Splunk with the Hybrid Cloud Console so that Splunk can receive event notifications from the Hybrid Cloud Console. The setup automation performs the following tasks:

Before you begin
Copy link

  • You have Organization Administrator permissions for the Hybrid Cloud Console.
  • You have Splunk login credentials:
    • To install applications on Splunk Cloud Platform, you must have the Splunk Cloud Administrator sc-admin role.
    • To install applications on Splunk Enterprise, you must have the admin role. For more information about creating the admin role, see Create secure administration credentials in the Splunk documentation.
  • Popup blockers are disabled in your browser.
  • Creates a user group with the Notifications administrator role using Organization Administrator permissions. You can also create the user group manually. For more information about manual configuration, see manually-configure-notif-admin-group.dita#proc-notif-splunk-manual-config-admin.
  • Uses the Splunk HEC URL and HEC token to create a new integration called SPLUNK_AUTOMATION, with the integration type Splunk.
  • Creates a new behavior group called SPLUNK_AUTOMATION_GROUP on the RHEL bundle. The group includes an action to send notifications to the SPLUNK_AUTOMATION Splunk integration.
  • Assigns the new behavior group SPLUNK_AUTOMATION_GROUP to all Hybrid Cloud Console services. This forwards the events from all services to Splunk. Currently, the behavior group forwards events from the Advisor, Policies, Drift, Compliance, Malware Detection, Patch, and Vulnerability services.

When Splunk begins to receive notifications from the Hybrid Cloud Console, the Red Hat Insights application for Splunk dashboard shows event activity. Each number contains a hyperlink to the Hybrid Cloud Console.

img evnt splunk dashboard2

Procedure
Copy link

  1. Install the Red Hat Insights (Red Hat Lightspeed) application for Splunk:
    1. Log in to Splunk.
    2. On the home page, click Find more apps under the Apps heading on the left of the screen. The Browse More Apps page opens.
    3. Enter Red Hat Insights in the filter box and then press the Enter key.
    4. Select Red Hat Insights and then click Install.
    5. Confirm or enter your Splunk username and password and then click Agree and Install. When the installation process completes, the Complete dialog box opens.
  2. Set up the Red Hat Insights application for Splunk:
    1. In the Complete dialog box, click Open the App. The App configuration page opens.
    2. Click Continue to app setup page. The Set up integration with Red Hat Insights page opens. The page includes the HTTP Event Collector (HEC) name and default index fields.

      img evnt splunk start2

    3. Under Create Red Hat Default Index, click Settings > Index. The Indexes page opens in a new tab.
    4. On the Indexes page, click New Index.
    5. Type a name for the index in the Name field (for example, redhatinsights).
    6. Enter values in the Max raw data size and Searchable retention (days) field.
    7. Click Save. The index you created appears in the Indexes list. It is enabled by default.
    8. On the first Splunk screen, on the Set up integration with Red Hat page, type the name for the HEC in the HEC name field (for example, redhatinsights).
    9. Type the name of the index you just created in the Default index field (for example, redhatinsights) and then click Next.
    10. Click Review and then click Submit. The HEC name that you created appears in the HEC Name field.
    11. Click Next to create the HEC URL and HEC Token.

      img evnt create hec

  3. Configure Splunk integration in Red Hat Insights (Red Hat Lightspeed):
    1. Click Copy to copy the HEC URL value in Splunk Enterprise.
    2. Click Next: Configure Splunk integration in Red Hat Insights. The Hybrid Cloud Console opens in a new browser tab.
      Note
      The Next: Configure Splunk integration in Red Hat Insights button is disabled until you click the Copy button for either the HEC URL or HEC token.
    3. In the Hybrid Cloud Console, navigate to Settings > Integrations.
    4. Click the Reporting & Automation tab.
    5. Click Add Integration.
    6. Click Splunk and then click Next.
    7. Enter a name for the integration (for example, SPLUNK_INTEGRATION).
    8. Paste the HEC URL value into the Endpoint URL field.
    9. Enter the Splunk HTTP event collector token in the Secret token field.
      Note

      If the new tab for the console does not open, disable the popup blocker in your browser.
    10. Add the port, if needed. The default port for Splunk Cloud Platform is 443. The default port for Splunk Enterprise and Splunk Cloud free trial is 8088.

      img evnt paste hec in hcc2

    11. Optional: If you are using Splunk Cloud, edit the HEC URL that you pasted into the Splunk HEC URL field on the Integrations page to match the Splunk Cloud format:
      • Use the following format for Splunk Cloud Platform on all clouds except Google Cloud: 
        <protocol>://http-inputs-<host>.splunkcloud.com:<port>
      • Use the following format for Splunk Cloud Platform on Google Cloud: 
        <protocol>://http-inputs.<host>.splunkcloud.com:<port>

        Replace the following placeholders:

      • protocol: Either http or https.
      • host: The name of the Splunk Cloud Platform instance that runs the HEC, followed by the domain .splunkcloud.com.
      • port: The HEC port number (443 by default on Splunk Cloud Platform instances).

        Examples:

      • Splunk Cloud Platform on GCP using JSON: 
        https://http-inputs.myhost.splunkcloud.com:443
      • Splunk Cloud free trial on AWS using raw events: 
        https://http-inputs-otherhost.splunkcloud.com:443
  4. Complete the setup process:
    1. Copy the HEC Token value in Splunk and paste it into the Splunk HEC Token field in on the Hybrid Cloud Console Integrations page.
    2. In the Hybrid Cloud Console, click Run configuration. The Hybrid Cloud Console sets up the integration, creates the behavior group, and associates Hybrid Cloud Console events to the behavior group. The status message section on the right side of the page shows the status of each of these actions.

      img evnt run config in hcc

    3. When the setup completes successfully, click Next: Review. The application returns the message Splunk integration in Insights completed.

      img evnt hcc config complete

    4. Click Go back to the Splunk application. This redirects you to the Set up integration with Red Hat screen in Splunk.
    5. Click Finish set up to complete the setup in Splunk.

      img evnt splunk setup complete

    6. Click Go to dashboard to be redirected to your Splunk dashboard.

      img evnt splunk dashboard

      Note

      If the integration configuration fails during the Red Hat Insights application setup process, contact Red Hat support.
  5. To view a list of Hybrid Cloud Console events on the Splunk dashboard, click the Events tab. Each event is hyperlinked to the Hybrid Cloud Console.

    splunk events log

Enable the HEC token
Copy link

Before Splunk can receive Hybrid Cloud Console events, you must enable the HEC token. For more information about the HEC token in Splunk Cloud, see Configure HTTP Event Collector on Splunk Cloud Platform in the Splunk documentation.

Before you begin
Copy link

  • You have Organization Administrator permissions for the Hybrid Cloud Console.
  • You have Splunk login credentials:
    • On Splunk Cloud Platform, you must have the Splunk Cloud Administrator sc-admin role.
    • On Splunk Enterprise, you must have the admin role. For more information about creating the admin role, see Create secure administration credentials in the Splunk documentation.

Procedure
Copy link

  1. From the Splunk home page, navigate to Settings.
  2. Select Data Inputs, and then select HTTP Event Collector. The HTTP Event Collector page shows the HEC, its Token value, the corresponding index that you selected during setup, and the status of the HEC.

    img evnt splunk hec screen

  3. Click Global Settings in the upper right corner of the page. The Edit Global Settings dialog box displays.

    img evnt splunk global settings

  4. Select Enabled. This enables the HEC token that was automatically created during the setup process.
    Note
    The HEC token uses a default HTTP port number of 8088. If you are using a different port (such as port 443 for Splunk Cloud), you must update your Hybrid Cloud Console Splunk integration to match.

Manually configure a Notifications administrator group in your account
Copy link

The Red Hat Insights (Red Hat Lightspeed) application for Splunk automated installation and setup process automatically configures a Notifications administrator role and group in your Hybrid Cloud Console account. However, you can create the Notifications administrator manually.

Before you begin
Copy link

  • You are logged in to the Hybrid Cloud Console with the Organization Administrator role. Note
    You cannot log in to the Hybrid Cloud Console with your email address unless your email address is the same as your Red Hat login. For more information, see ../get-started/access-hcc.dita#finding-login.

Procedure
Copy link

  1. Click Settings > Identity & Access Management.
  2. Under Identity & Access Management, expand User Access if necessary, and select Groups.
  3. Click Create group. The Name and description page appears.
  4. Enter a name for the group (for example, splunknotifgroup), enter a description, and then click Next. The Add roles page opens.
  5. To add the Notifications administrator role, enter notif in the search box.
  6. Select Notifications administrator from the search results list, and then click Next. The Add Members page opens.
  7. Select the users to add to this group. You can use the search box to search for specific names.
  8. Click Next. The Review Details page opens.
  9. Review the information, and then click Submit to create the group.
  10. Click Exit. The Groups page opens.

What to do next
Copy link

Verify your group:

  1. Enter the new group name in the search box.
  2. Click the group name. The page for the group opens.
  3. On the Roles tab, verify that the group has the Notifications administrator role.
  4. Click the Members tab and verify that the group includes the correct members.

Manually configure a Splunk integration
Copy link

The Red Hat Insights (Red Hat Lightspeed) application for Splunk automated installation and setup process automatically configures Splunk integration to your Hybrid Cloud Console account. Use this procedure if you want to configure the integration manually.

Before you begin
Copy link

  • You have an HTTP Event Collector (HEC) URL from Splunk Cloud or Splunk Enterprise.
  • You have the HEC token value from Splunk Cloud or Splunk Enterprise.
  • You are logged in to the Hybrid Cloud Console with the Notifications administrator role. Note
    You cannot log in to the Hybrid Cloud Console with your email address unless your email address is the same as your Red Hat login. For more information, see ../get-started/access-hcc.dita#finding-login.
  • Your Splunk instance has an SSL certificate that is signed by a globally trusted certificate authority (CA).
  • Your Splunk instance must be accessible to the Red Hat IP addresses listed in ../troubleshoot/troubleshoot-connection-ip-address.dita#ref-if-address-troubleshooting.

Procedure
Copy link

  1. In the Hybrid Cloud Console, navigate to Settings > Integrations.
  2. Select the Reporting & Automation tab.
  3. Click Add integration.
  4. Select Splunk as the integration type, and then click Next.
  5. Enter a name for your new integration in the Integration name field (for example, redhat_splunk).
  6. In the Endpoint URL field, add your Splunk HEC endpoint URL:
    1. For Splunk Enterprise, Splunk uses port 8088 by default. For example: https://<splunk-endpoint>:8088
    2. For Splunk Cloud, Splunk uses port 443. For more information about Splunk Cloud on AWS or GCP, see Send data to HTTP Event Collector.
      Note

      The service automatically adds <endpoint> (the http path). You do not need to include it in the form input for the Endpoint URL.

      The following examples show endpoint URLs with the correct port numbers for Splunk platforms.

      • On premise (Splunk Enterprise): https://splunk.company.com:8088
      • Splunk Cloud (on AWS): https://http-inputs-mycompany.splunkcloud.com:443
      • Splunk Cloud (on GCP): https://http-inputs.mycompany.splunkcloud.com:443
  7. In the Secret token field, add the Splunk HEC token value.
  8. Click Next.
  9. Review the integration details and click Submit.

Update the Red Hat Lightspeed application for Splunk
Copy link

To update the Red Hat Insights (Red Hat Lightspeed) application for Splunk, the procedure is similar to the steps required for the initial installation. These steps ensure the application is properly set up with your environment after the update.

Before you begin
Copy link

  • You have Organization Administrator permissions for the Hybrid Cloud Console.
  • You have Splunk login credentials:
    • To install applications on Splunk Cloud Platform, you must have the Splunk Cloud Administrator sc-admin role.
    • To install applications on Splunk Enterprise, you must have the admin role. For more information about creating the admin role, see Create secure administration credentials in the Splunk documentation.
    • You have a Splunkbase account.
  • You have the Red Hat Insights application installed on Splunk.
  • Popup blockers are disabled in your browser.
Note
Updating the Red Hat Insights application does not trigger a Splunk restart. Additionally, no system restart is required as part of this process.

Procedure
Copy link

  1. From the Splunk dashboard, click Apps > Manage Apps to view a list of apps.
  2. Locate the Red Hat Insights application, and then click the Splunkbase link under the App Origin column.
  3. Log in to Splunkbase. The Red Hat Insights application page opens.
  4. Click the Download button to download the Red Hat Insights application .tgz file.
  5. Return to the Splunk dashboard and click Apps > Manage Apps.
  6. Click the Install App From File button to open the installation dialog.
  7. In the installation dialog, click Browse and then select the Red Hat Insights application .tgz file you downloaded.
  8. Select the Upgrade app checkbox to confirm you want to overwrite the previous version of the Red Hat Insights application.
  9. Click Upload.
    When the upload is complete, a success banner displays to confirm that the app has been upgraded.