Archive

How to retrieve G Suite email tracking logs to Splunk?

New Member

Hi,

Is it possible to collect email audit logs from G Suite to Splunk?

Thanks.

Tags (1)
0 Karma

Path Finder

@ColinJacksonPS Sorry about the late response on this one. Do you have the GSuite for Splunk Add-on installed on the HF as well? There is a dependency on that add-on for the authorization process.

@CSULeigh Yes, it definitely will. Hopefully by the end of the month.

0 Karma

Path Finder

Hi @nieyf

I recently had a similar requirement at a customer. I couldn't find anything to do what I wanted, so I wrote some scripts to do this.

The scripts are now available through the Gmail Audit add-on on Splunkbase:
https://splunkbase.splunk.com/app/4560/

0 Karma

Path Finder

@nieyf Did you get a chance to try the add-on yet? Did this meet your needs? If so, please accept the answer. Cheers.

0 Karma

Explorer

@nvonkoff Will the Gmail Audit add-on be updated to support Splunk 8.x?

Path Finder

I just tried your add-on. I think it's different than documented in your blogpost: https://nvonkorff.github.io/splunk/gmail/audit/2019/06/23/Gmail_Audit_TA.html

I never got to the authorize steps inside the TA_gmail_audit app. Just the creds page and set up inputs with the HEC token.
I'm on Splunk Cloud, but installed this on a local HF. Any advice?

0 Karma

Influencer

Hi

There is an App an TA and an input TA for G Suite check them if there include what you are looking for https://splunkbase.splunk.com/apps/#/search/G%20Suite/

You can find a documentation in the details tab of the app

0 Karma

Influencer

Please accept the answer if it helped you 🙂 thank you

0 Karma

Path Finder

Same thing here. I got a few gmail logs from the reports API, but stopped and I can't get it back. This is after reinstalls, reauthorizing, etc.

0 Karma

New Member

Hi dkeck,

Thanks for the response, I have tried to use this APP to collect G Suite email tracking logs, but seems it doesn't support relative email api, the APP can get the logs of G Suite Drive, but no gmail logs...

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!