topic Best way to connect Splunk and Cloudflare in Getting Data In

Best way to connect Splunk and Cloudflare

vadim_osipov — Mon, 20 Dec 2021 08:55:20 GMT

Hey guys,

I am a nebbie with Splunk, but already fell in love with it. Such a great tool!

I was tasked with storing settings of a website from Cloudflare into Splunk. Without much of a knowledge I wrote a small Python script that basically gets settings data from CF and sends it to Splunk via HEC token, on my local instance. This is one of the ways of doing it, but I'm sure there must be much slicker way.

Question is, what would you guys recommend to achieve this task? What would be the best practices?

Thanks in advance,

Vadim

Re: Best way to connect Splunk and Cloudflare

aasabatini — Mon, 20 Dec 2021 10:26:28 GMT

Hi @vadim_osipov

the best pratices is:

use the official add-on on the splunkbase

https://splunkbase.splunk.com/app/5114/

this add-on is directly developed from cloudflare.

Regards

Re: Best way to connect Splunk and Cloudflare

vadim_osipov — Mon, 20 Dec 2021 18:55:50 GMT

Thanks for a reply!

I looked into it and cant a decent way in this App(https://splunkbase.splunk.com/app/5114/) to store settings out of Cloudflare. Maybe I am missing something?

Thanks!

Re: Best way to connect Splunk and Cloudflare

aasabatini — Tue, 21 Dec 2021 15:33:35 GMT

Hi @vadim_osipov

which issue do you have with the add-on?

Re: Best way to connect Splunk and Cloudflare

vadim_osipov — Fri, 24 Dec 2021 13:10:38 GMT

I don't necessarily have an issue with the add-on. I just don't see how can I gather "settings" of the website using it. Maybe that just escapes me, maybe I'm not too familiar with usage of this. If you could possibly point me to a proper solution. I'd surely appreciate it.

Re: Best way to connect Splunk and Cloudflare

gordo32 — Mon, 03 Jan 2022 14:11:52 GMT

That add-on should point to this URL for instructions on how to configure Cloudflare logging: https://developers.cloudflare.com/logs/about

If you download and unzip the add-on, you'll find this URL in the readme.txt, but it should really be added to the Overview page on Splunkbase.

Gord T.

Re: Best way to connect Splunk and Cloudflare

aasabatini — Sun, 09 Jan 2022 11:24:37 GMT

Hi @vadim_osipov

If you read the documentation you can see you need to use a amazon S3bucket to mange the queue.

check the documentation