topic Re: No Dome input options after installing dome9 in All Apps and Add-ons

No Dome input options after installing dome9

MikeBertelsen — Fri, 13 Oct 2017 15:52:27 GMT

I installed the Splunk AWS app, add on and Dome9 app
Going through the configuration I am unable to select a dome type under data inputs.

Re: No Dome input options after installing dome9

amiracle — Fri, 13 Oct 2017 15:59:52 GMT

Hello Mike,

Make sure that you are using the Dome9 App for Splunk : https://splunkbase.splunk.com/app/3203/ Once you setup the App, to collect the data you will need to follow these instructions : https://github.com/amiracle/splunk_app_dome9

The data from Dome9 will come through an SNS topic that can be sent to Splunk via a Lambda Function into the Splunk HTTP Event Collector (HEC).

Let me know if that helps you get your Dome9 data into Splunk.

Re: No Dome input options after installing dome9

MikeBertelsen — Tue, 29 Sep 2020 16:23:44 GMT

I had done all that. Today I uninstalled the splunk_app_dome9, splunk_app_aws & Splunk_TA_aws.

Next reinstalled/configured splunk_app_aws and Splunk_TA_aws.
Reinstalled splunk_app_dome9.

Same results, there is no sourcetype aws:dome9 available to select when creating the new token.

Re: No Dome input options after installing dome9

amiracle — Mon, 23 Oct 2017 17:32:36 GMT

Did you try the source type aws-dome9 ?

Re: No Dome input options after installing dome9

MikeBertelsen — Mon, 23 Oct 2017 18:23:58 GMT

I would but it is not available to select.

Re: No Dome input options after installing dome9

MikeBertelsen — Mon, 23 Oct 2017 18:25:14 GMT

Re: No Dome input options after installing dome9

amiracle — Mon, 23 Oct 2017 18:38:13 GMT

You should be able to type in dome9 in the filter and the sources will show up. I would recommend that you use the aws:dome9 source type then it shows up.

Re: No Dome input options after installing dome9

MikeBertelsen — Mon, 23 Oct 2017 18:40:49 GMT

Ok. Got it now.
It was available after I enabled the global.
Then I was able to add the token.
Log into your Splunk instance and click on Settings -> Data Inputs -> HTTP Event Collector. Click on Create New Token. Name the input "Dome9 Input" then click Next.

Select the correct source type "aws:dome9", leave the Default Index as "Default." Click Review, then Submit.

Copy the Token Value and keep it ready.

Finally, enable the token by clicking on "Global Settings" and enable the tokens.