No Dome input options after installing dome9

[MikeBertelsen]

I installed the Splunk AWS app, add on and Dome9 app
Going through the configuration I am unable to select a dome type under data inputs.

[amiracle · Accepted solution]

You should be able to type in dome9 in the filter and the sources will show up. I would recommend that you use the aws:dome9 source type then it shows up.

[MikeBertelsen]

[amiracle]

Hello Mike,

Make sure that you are using the Dome9 App for Splunk : https://splunkbase.splunk.com/app/3203/ Once you setup the App, to collect the data you will need to follow these instructions : https://github.com/amiracle/splunk_app_dome9

The data from Dome9 will come through an SNS topic that can be sent to Splunk via a Lambda Function into the Splunk HTTP Event Collector (HEC).

Let me know if that helps you get your Dome9 data into Splunk.

[MikeBertelsen]

I had done all that. Today I uninstalled the splunk_app_dome9, splunk_app_aws & Splunk_TA_aws.

Next reinstalled/configured splunk_app_aws and Splunk_TA_aws.
Reinstalled splunk_app_dome9.

Same results, there is no sourcetype aws:dome9 available to select when creating the new token.

[amiracle]

Did you try the source type aws-dome9 ?

[MikeBertelsen]

I would but it is not available to select.

[MikeBertelsen]

Ok. Got it now.
It was available after I enabled the global.
Then I was able to add the token.
Log into your Splunk instance and click on Settings -> Data Inputs -> HTTP Event Collector. Click on Create New Token. Name the input "Dome9 Input" then click Next.

Select the correct source type "aws:dome9", leave the Default Index as "Default." Click Review, then Submit.

Copy the Token Value and keep it ready.

Finally, enable the token by clicking on "Global Settings" and enable the tokens.