topic Splunk Integration in Getting Data In

Splunk Integration

devraajpandya11 — Wed, 01 May 2024 17:36:08 GMT

How do i integrate my website hosted on AWS(ec2) with splunk?

Re: Splunk Integration

deepakc — Wed, 01 May 2024 17:42:49 GMT

At a high Level:

Think about what data you want from your website, is it OS logs Application logs, Security Logs etc and identify them.
For those logs you want is there a Splunk TA - Search on Splunk Base. (This will help with the data integration and parse the data).
Install a Universal Forwarder onto the Web Hosted Servers and monitor the logs or other methods are API and Splunk HEC.
You may even have to use a Heavy Forwarder to collect the logs - this depends on the logs/data you want and your Splunk architecture.

Re: Splunk Integration

apietsch — Tue, 07 May 2024 08:23:48 GMT

Just collecting the logs is a great start.

If you want to collect technical metrics about user interaction you can use the RUM integration as well.

And depending what your backend looks like you could use the opensource OpenTelemetry libraries to instrument your backend application that processes your web application data. There is even a free and opensource Splunk distribution of OpenTelemetry (including the collector) available.

Re: Splunk Integration

PickleRick — Tue, 07 May 2024 12:11:09 GMT

Depends on what do you want to "integrate". Do you want to collect events generated by your web app/web server? Do you want to collect metrics about your server? Do you want to embed reports from Splunk on your website? Do you want to be able to perform some action on your Splunk environment from your web app? Something else?