What is the best way to forward Jamf Pro logs to Splunk?

[AlexeySh]

Hello,

We trying to export Jamf Pro logs to Splunk. Splunk is not officially supported by Jamf, but there’s a Splunk app on GitHub which integrates search APIs in Jamf Pro with Splunk’s modular input.

Technically it looks easy, just a repository to clone and configuration to write in default/inputs.conf file.

But we weren’t able to find which values we should write for ‘api_call’ and ‘search_name’ parameters.

Do you have any ideas? Or do you know a better way to import Jamf Pro logs to Splunk?

Thanks for the help.

Regards,
Alex.

[hfernandez_ · Accepted solution]

Hi AlexeySh,

Did you find a good Splunk/JAMF integration solution? I'm looking for one too. I just saw that a new add-on was released:

Jamf Pro Add-on for Splunk - https://splunkbase.splunk.com/app/4729/

I wanted to see if you gave this a try.

Thanks,
Herman

[AlexeySh]

Hi Herman,

Actually the add-on works great. It looks like it's the simplest way to import Jamf inventory to Splunk. The remaining step is to parce imported events correctly.

Thanks for the help!
Alex.

[hfernandez_]

Hi Alex,

I just implemented the Jamf add-on, but I'm not getting any data. For config, I used

JSS URL https://ourjamf_website.com:443

API Call Name: computer <default>
Search Name:  /JSSResource/computers

Is that what you used to get the data in?

Thanks,
Herman

[hfernandez_]

ah, i figured it out. I'm suppose to custom instead of computer.

Thanks,

[spayneort]

You could possibly do something like this Jamf Graylog Integration using the Splunk Java Logging Appenders.

Documentation
Example Configs

[AlexeySh]

Hi @spayneort ,

Thank for the answer. But I'm afraid I do not have enough skills to implement it 😞