How to retrieve G Suite email tracking logs to Splunk?

[nieyf]

Hi,

Is it possible to collect email audit logs from G Suite to Splunk?

Thanks.

[nvonkorff]

@ColinJacksonPS Sorry about the late response on this one. Do you have the GSuite for Splunk Add-on installed on the HF as well? There is a dependency on that add-on for the authorization process.

@CSULeigh Yes, it definitely will. Hopefully by the end of the month.

[nvonkorff]

Hi @nieyf

I recently had a similar requirement at a customer. I couldn't find anything to do what I wanted, so I wrote some scripts to do this.

The scripts are now available through the Gmail Audit add-on on Splunkbase:
https://splunkbase.splunk.com/app/4560/

[nvonkorff]

@nieyf Did you get a chance to try the add-on yet? Did this meet your needs? If so, please accept the answer. Cheers.

[CSULeigh]

@nvonkoff Will the Gmail Audit add-on be updated to support Splunk 8.x?

[ColinJacksonPS]

I just tried your add-on. I think it's different than documented in your blogpost: https://nvonkorff.github.io/splunk/gmail/audit/2019/06/23/Gmail_Audit_TA.html

I never got to the authorize steps inside the TA_gmail_audit app. Just the creds page and set up inputs with the HEC token.
I'm on Splunk Cloud, but installed this on a local HF. Any advice?

[dkeck]

Hi

There is an App an TA and an input TA for G Suite check them if there include what you are looking for https://splunkbase.splunk.com/apps/#/search/G%20Suite/

You can find a documentation in the details tab of the app

[dkeck]

Please accept the answer if it helped you 🙂 thank you

[ColinJacksonPS]

Same thing here. I got a few gmail logs from the reports API, but stopped and I can't get it back. This is after reinstalls, reauthorizing, etc.

[haimchibotero]

Hi All,

hope you are doing well.

any luck to make this work . for some reason the authorization process is working great , but you can't save the info 

i tried this on 3 new installs one with version 8.1.3 and with 8.1.4 and with 8.1 even 

all is acting the same 😞

[nieyf]

Hi dkeck,

Thanks for the response, I have tried to use this APP to collect G Suite email tracking logs, but seems it doesn't support relative email api, the APP can get the logs of G Suite Drive, but no gmail logs...