topic Re: DUO Log Add-on for Splunk setup in All Apps and Add-ons

DUO Log Add-on for Splunk setup

SamAlo — Wed, 03 Aug 2016 12:05:56 GMT

After installing the Duo Add-on i am not seeing "DUO Security 2fa logs" in data inputs. Is this compatible with version 6.4? Are there any special instructions after the app has been installed to get it to show up?

Re: DUO Log Add-on for Splunk setup

bawood — Wed, 03 Aug 2016 15:34:40 GMT

I just tried installing on a clean 6.4.2 Splunk and the data input showed up and I'm not aware of any compatibility issues it would have with 6.4. It shouldn't even require a restart, but you could try that if you haven't already.

Re: DUO Log Add-on for Splunk setup

SamAlo — Wed, 03 Aug 2016 18:08:50 GMT

Is it under Scripts? Under data inputs what "type" would it be under?

Re: DUO Log Add-on for Splunk setup

bawood — Wed, 03 Aug 2016 19:26:10 GMT

It should be it's own type, "DUO Security 2fa logs" in the Local section.

Re: DUO Log Add-on for Splunk setup

bawood — Wed, 03 Aug 2016 19:33:15 GMT

You should also be able to find it under the "Add Data" dialog;
try appending this path to your Splunk server's url:
"en-US/manager/TA-DUOSecurity2FA/adddata/selectsource?input_mode=1"

Re: DUO Log Add-on for Splunk setup

SamAlo — Wed, 03 Aug 2016 21:10:29 GMT

Found it. Testing it out now.

Thanks for your help

Re: DUO Log Add-on for Splunk setup

robert_miller — Wed, 09 Nov 2016 16:57:21 GMT

Where did you find it? I am not seeing it and that URL doesn't work on 6.5.