All Apps and Add-ons

Getting Google logs into Splunk

Glasses
Builder

Hi-

I am trying to get a number of Google G Suite / Workspace logs, GCP logs, etc into Splunk for security monitoring.

I have been trying the various apps by Kyle Smith, but they don't get me everything I am required to collect.

Currently we use python scripts to call the Google API and pull in our logs with a UF.  But I was hoping there was a better way (by now).  

I was hoping there is a way to redirect/store my G-suite logs into Google Storage and then pull it into Splunk with the (Splunk Supported) GCP app?  Like using the AWS TA and an S3 bucket.

I have not been able to test my theory yet, but if any one can advise how to collect MDM and Alert Center Logs with the GCP app that would be great.

TY!

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Mastering Threat Intelligence in ES 8.5, Splunk AI Assistant v2, and More from Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Break the Build: Inside the KubeDoom Lounge at .conf26

    You step up to the machine. The pixelated corridors of a certain 1993 FPS load in front of you, EMP Pulse ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...