How to collect logs from Informatica public APIs ?

[amirahmed]

Hi Splunk Team,

We are planning to integrate Informatica IDMC logs with Splunk using Informatica's public REST APIs.

Could you please advise on the recommended way to collect logs from an external REST API into Splunk, and whether there is a native Splunk solution or add-on available for this?

Any guidance or documentation on how to get started would be appreciated.

[cartergray70543]

You can use a scripted input or HEC to pull Informatica IDMC data through its REST APIs and send it into Splunk. If there’s no native add-on, a small custom integration is usually the simplest approach.

[livehybrid]

Hi @amirahmed 

It doesnt look there is an existing Splunkbase app for Informatica logs to be pulled into Splunk, I would suggest looking at using AddOn Builder or UCC Framework to build a custom app to ingest this (typical Python input) or you may be able to use the REST API Modular Input or WebTools Add-On to run curl-type requests with a custom command to poll the data - but creating a custom app would typically be the preferred route.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful

• Marking it as the solution if it resolved your issue

• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

[gcusello]

Hi @amirahmed ,

as @livehybrid pointed on, there isn't any add-on on Splunkbase for  Informatica IDMC, this means that you have to create a custom add-on, that I hint to publish on Splunkbase for the other users.

So the first step is to understand which data can you extract from your system for your scopes but at first you should define the perimeter of your job: 

• do you need only security events or also ITOPS?
• do you need business insight data?
• which data do you need to extract for your purpose?

I'd like to say: extract all the data, but probably you need only a subset of them.

After this first step, you should identify the Splunk Data Models where storing these data and the data structure to extract (fields, values, etc...).

At least the way to extract these data.

Probably the creation od python scripts that use REST API is the best solution, also using the splunk features to encrypt account credentials.

To do this last step, as @livehybrid hinted, you should at first create the scripts and then package them in an add-on using Add-On Builder, in this way you'll have a well packaged add-on with a correct normalization for use in Splunk.

Ciao.

Giuseppe