topic Re: ingest gitlab audit logs to splunk in Getting Data In

How to ingest gitlab audit logs to Splunk?

aman35 — Thu, 28 Apr 2022 20:30:45 GMT

Hi All,

I am new to splunk. We are using splunkcloud and version 8.2.

We are exploring how to ingest gitlab audit logs in splunk.

I checked gitlab project audit add on is not available in splunkcloud. I have tested HEC endpoints. For me my HEC working from curl https request.

But I am clueless how can I ingest gitlab logs to splunk and keep this process realtime and automated.

Please suggest.

Thanks in advance.

Re: ingest gitlab audit logs to splunk

PickleRick — Thu, 28 Apr 2022 19:57:21 GMT

Doesn't gitlab simply produce log files? So you could just install a Universal Forwarder and ingest local files?

Just asking, don't know gitlab.

Re: ingest gitlab audit logs to splunk

aman35 — Thu, 28 Apr 2022 20:27:11 GMT

It does produce the log files.. But I never tried forwarder and ingestion. Can you please shed some light on it.

It will be great help if I can get some documentation about it.

Re: ingest gitlab audit logs to splunk

richgalloway — Thu, 28 Apr 2022 23:51:13 GMT

https://docs.splunk.com/Documentation/Splunk/latest/Data/Getstartedwithgettingdatain

Re: ingest gitlab audit logs to splunk

aman35 — Fri, 29 Apr 2022 20:49:24 GMT

thank you @ricm @PickleRick .

But I think splunkcloud does not use forwarders. it use IDM. we are using gitlab saas

Re: ingest gitlab audit logs to splunk

richgalloway — Fri, 29 Apr 2022 21:14:18 GMT

Splunk Cloud uses forwarders and IDM. IDMs are not available for all stacks. However, all Splunk Cloud customers can use forwarders to get data from their on-prem servers to Splunk Cloud.

To get data from another cloud service, you can use an IDM (if available) or an input on your Cloud search head (if on the Victoria experience) or a on-prem heavy forwarder. Using the IDM requires asking Splunk Support to install an appropriate app for you. The other solutions are self-service.

Re: ingest gitlab audit logs to splunk

Roy_9 — Fri, 29 Apr 2022 21:49:54 GMT

@aman35 you could poll the data using REST API by building a custom-addon using splunk add-on builder or if these logs are writing to a file, you could monitor/read it by installing a splunk agent .

Coming to splunk cloud, splunk cloud SH provides universal forwarder crdentials package..

If you are using UF approach, you need to download these credentials and place it on the splunk UF @/opt/splunkforwarder/etc/apps location and create a gitlab app with inputs.conf and deploy it to the same location and perform a splunk restart.