splunk
Swit Add-on for Splunk
Overview
Details
This app is designed to access and provide Swit organization audit logs subscribe
This app uses the Swit Audit Logs API to store logs in Splunk through the Log Pull method.
Installation
This app can be installed on On-Prem or Cloud deployments of Splunk.
Installation steps for On-prem
- Download this app from Splunkbase.
- Install it manually by adding the installation file to your Heavy Forwarder (HF) or SearchHeader.
Installation steps for Cloud
[Splunk Classic Cloud]
You cannot install an app directly on Classic. Please request Splunk to install it for you through a support ticket.
[Splunk Victoria Cloud]
Search for “Swit Add-on for Splunk” in "Apps" and install it directly.
Configuration steps
The configuration steps are common for On-prem and Cloud.
- Open the Web UI where you installed this app.
- In the “Manage Apps” section in Splunk, find the Swit Add-on for Splunk and go to the settings.
- Click on the “Add token” button to generate your access token for using the Swit Audit Logs API and save the generated token value.
- Go to Splunk Settings > Data > Data Inputs and find “Swit Audit Logs Modular Input”, then click “New” to enter the input.
- Name: Provide a name for the input
- API Key: Provide the access token value you saved in Step 3
- Interval: Provide a number in seconds for the query interval
- Source type: Select JSON for the source type from the dropdown list
- Index: Select the index to store the collected data
- Once you provide the inputs correctly, the log collection will be started.
Release Notes
Version 1.2.2
June 25, 2024
Version 1.2.1
June 22, 2024
Version 1.2.0
June 20, 2024
Version 1.1.1
March 28, 2024
Version 1.1.0
March 6, 2024
- bug fix
Version 1.0.10
Feb. 26, 2024