Akamai SIEM add-on configuration IDs in batch

[splunklearner]

We are currently pulling Akamai logs to Splunk using akamai add-on in Splunk. As of now I am giving single configuration ID to pull logs. But akamai team asked to pull bunch of config ID logs at a time to save time. But in name field we need to provide Service name (Configuration ID app name) and this will be different for diff config IDs and there will be single index and they will filter based on this name provided. How to on-board them in bulk and how to give naming convention there? Please help me with your inputs.

[livehybrid]

Hi @splunklearner 

In terms of naming conventions - anything which makes sense to you and your team, such as siem_<configID>.

Regarding bulk-creation, this is tricky due to the nature in which Splunk stores secure credentials, one thing you could script something with something like Curl or Python requests, here is a CURL example on how you could create a single input, you will need to tweak this for your environment and config:

curl 'https://yourSplunkInstance:8089/services/data/inputs/TA-Akamai_SIEM/YOUR_INPUT_NAME' \
  -H "Authorization: Bearer <your_splunk_token>" \
  -d "hostname=testing.cloudsecurity.akamaiapis.net" \
  -d "security_configuration_id_s_=1234" \
  -d "client_token=clientTokenHere" \
  -d "client_secret=clientSecretHere" \
  -d "access_token=accessTokenHere" \
  -d "initial_epoch_time=optional_InitialEpochTime" \
  -d "final_epoch_time=optional_finalEpochTime" \
  -d "limit=optional_limit" \
  -d "log_level=INFO" \
  -d "proxy_host=" \
  -d "proxy_port=" \
  -d "disable_splunk_cert_check=1" \
  -d "interval=60" \
  -d "sourcetype=akamaisiem" \
  -d "index=main" 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing