Archive
Highlighted

Splunk 2fa with Google Authenticator?

Builder

All,

Has anyone ever setup Google Authenticator with Splunk for 2fa? Any walk throughs available for Splunk Enterprise 8?

Highlighted

Re: Splunk 2fa with Google Authenticator?

New Member

Hi daniel333,
I realize that this question was asked quite a while back, but in case this is still an issue for you or anyone else I'll try and answer this question as best I can.
If you already configured your mail settings under Settings -> Server Settings -> Email settings and configured an alert, just as I did and noticed that no mail was sent when the trigger occurred. Then what you could do is run the following search index=_internal source="/opt/splunk/var/log/splunk/python.log" sendemail. This gave me an event stating "Application-specific password required" and referred me to https://support.google.com/mail/?p=InvalidSecondFactor. The link explained who to create an App specific password. This generated password should be pasted in under the mail configuration in your Splunk environment.

The settings I used under splunk was.
Mail host: smtp.gmail.com:587
Email Security: Enable TLS
Username: [my.email@gmail.com]
Password: [The app specific password]

I hope this is of any help to you or anyone else having this issue and if this don't resolve your issue then the SPL query above can still provide valuable information as to where the issue lies.
Best of luck and happy Splunking

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.