How do we integrate AppNeta's observer feature with Splunk? We'd like to integrate the two.
Determine the following:
The URL for the specific Splunk server HEC raw events. It will be in the form
https://<Your Splunk Server .server.com> :8088/services/collector/raw
Under Settings > Data Input, select + Add New HTTP Event Collector
Assign a new name, fill in any optional value, and select next
Note: Extensive testing of the above setup wasn’t completed. It’s possible that other setups and configurations also work.
Using the values generated before, set up the Observer API, with the appropriate event configuration. Note the keyword “Splunk” added to the Authorization value.
[
{
"name": "Splunk customer raw feed",
"url": "http://<Your splunk.server.com >:8088/services/collector/raw",
"testEvents": false,
"seqEvents": false,
"sqaEvents": true,
"webAlertEvents": true,
"networkChangeEvents": false,
"headers": [
{
"name": "Authorization",
"value": "Splunk 86bfba07-XXXX-XXXX-XXXX-XXX67951a6fb"
},
{
"name": "X-Splunk-Request-Channel",
"value": "aaf27xxx-xc67-4ex-xxxx-xxxxd5587aee"
}
],
"blacklisted": false
}
]
Splunk is able to parse the JSON, even as raw data, and provide meaningful results.