topic Re: Splunk Add-on for Google Cloud Platform: How is the data coming? in All Apps and Add-ons

Splunk Add-on for Google Cloud Platform: How is the data coming?

alanzchan — Thu, 04 Apr 2019 20:21:41 GMT

I recently installed and configured this TA. For the configurations portion, only a JSON key from a GCP service account is needed; Splunk will then automatically scan for GCP projects and subscriptions. After selecting the desired project and subscriptions, Splunk is indexing data.

How exactly does this work? I was expecting there would be some firewall rules/ports that need to be configured before external data could be indexed.

Re: Splunk Add-on for Google Cloud Platform: How is the data coming?

timonix — Wed, 10 Apr 2019 16:27:59 GMT

It is utilizing publically accessible GCP API and a service account with permissions to access that API setup on the desired project.

Re: Splunk Add-on for Google Cloud Platform: How is the data coming?

sathwikr076 — Thu, 08 Aug 2019 16:10:26 GMT

@alanzchan can you please let me know where did you do all these configuration on search head or on indexer.

Thanks.

Re: Splunk Add-on for Google Cloud Platform: How is the data coming?

tyron_ — Wed, 20 Nov 2019 17:44:23 GMT

You should log this as a new question. But the answer is: neither. You should install the add-on on the heavy forwarders for data collection. Please refer to: https://docs.splunk.com/Documentation/AddOns/released/GoogleCloud/installation

Re: Splunk Add-on for Google Cloud Platform: How is the data coming?

sathwikr076 — Mon, 25 Nov 2019 17:15:31 GMT

Thanks for the reply.