topic Re: Akamai logs to Splunk in All Apps and Add-ons

Akamai logs to Splunk

splunklearner — Sun, 02 Mar 2025 07:27:27 GMT

Anyone please help me how to get Akamai logs to Splunk. We have clustered environment with syslog server uf installed in it and forwards data to our Deployment Server initially and then it deployes to Cluster Manager and Deployer. We have 6 indexers with 2 indexers in each site (3 site multi cluster). 3 search heads one in each site. How to proceed with this?

Re: Akamai logs to Splunk

kiran_panchavat — Sun, 02 Mar 2025 07:41:02 GMT

@splunklearner

Please follow this SIEM Splunk connector

Re: Akamai logs to Splunk

kiran_panchavat — Sun, 02 Mar 2025 07:49:38 GMT

@splunklearner

Install the add-on on your heavy forwarder and configure it. You have two options for sending logs to Splunk:

Install the add-on on your heavy forwarder and use it to send logs to Splunk.
If Akamai supports syslog, you can send logs to your syslog forwarder, which will then forward them to Splunk. In this case, please configure syslog-ng or rsyslog to capture Akamai logs in a specific directory and create the necessary inputs to onboard the logs into Splunk.

Configure the UF on your syslog server to monitor the log files. Update the inputs.conf file to specify the log file paths and the outputs.conf file to forward the data to your indexe

Example inputs.conf:

[monitor:///var/log/akamai/*.log]
index = akamai
sourcetype = akamaisiem

Re: Akamai logs to Splunk

kiran_panchavat — Sun, 02 Mar 2025 07:50:16 GMT

@splunklearner I recommend using the add-on. Akamai SIEM Integration | Splunkbase

Re: Akamai logs to Splunk

kiran_panchavat — Sun, 02 Mar 2025 07:54:14 GMT

@splunklearnerIf you don't have a heavy forwarder and need to install the add-on, you can install it on the search head cluster. Please refer to the documentation below for more details and installation instructions.

Install an add-on in a distributed Splunk Enterprise deployment - Splunk Documentation

To deploy an add-on to the search head cluster members, use the deployer. https://docs.splunk.com/Documentation/Splunk/9.4.1/DistSearch/PropagateSHCconfigurationchanges

Re: Akamai logs to Splunk

splunklearner — Sun, 02 Mar 2025 08:01:57 GMT

I am stuck at this point --

Click the Akamai Security Incident Event Manager API.

I can't find this in data inputs after installing add-on.

Re: Akamai logs to Splunk

kiran_panchavat — Sun, 02 Mar 2025 09:45:27 GMT

@splunklearner

Go to Settings > Data Inputs, where you will find the Akamai data input.

Re: Akamai logs to Splunk

kiran_panchavat — Sun, 02 Mar 2025 10:25:43 GMT

@splunklearner

Please check the pre-requisites . https://techdocs.akamai.com/siem-integration/docs/siem-splunk-connector

Re: Akamai logs to Splunk

splunklearner — Sun, 02 Mar 2025 11:10:22 GMT

Not able to find.

Re: Akamai logs to Splunk

kiran_panchavat — Sun, 02 Mar 2025 13:00:05 GMT

@splunklearner

Please verify the prerequisites. It's a Java issue, you need to make sure Splunk can access Java. I can see some solutions that, they are able to see the data inputs using the below steps:

Fixed the issue by adding the config in inputs.conf"[TA-Akamai_SIEM]#disable the running introspection.

run_introspection=false