Getting Data In

How to ingest gitlab audit logs to Splunk?

aman35
Observer

Hi All, 

I am new to splunk. We are using splunkcloud and version 8.2. 

We are exploring how to ingest gitlab audit logs in splunk.

I checked gitlab project audit add on is not available in splunkcloud. I have tested HEC endpoints. For me my HEC working from curl https request. 

But I am clueless how can I ingest gitlab logs to splunk and keep this process realtime and automated.

Please suggest.

 

Thanks in advance.

Labels (1)
0 Karma

PickleRick
Ultra Champion

Doesn't gitlab simply produce log files? So you could just install a Universal Forwarder and ingest local files?

Just asking, don't know gitlab.

0 Karma

aman35
Observer

It does produce the log files.. But I never tried forwarder and ingestion. Can you please shed some light on it.

It will be great help if I can get some documentation about it. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

https://docs.splunk.com/Documentation/Splunk/latest/Data/Getstartedwithgettingdatain

---
If this reply helps you, an upvote would be appreciated.
0 Karma

aman35
Observer

thank you @ricm @PickleRick . 

But I think splunkcloud does not use forwarders. it use IDM. we are using gitlab saas

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk Cloud uses forwarders and IDM.  IDMs are not available for all stacks.  However, all Splunk Cloud customers can use forwarders to get data from their on-prem servers to Splunk Cloud.

To get data from another cloud service, you can use an IDM (if available) or an input on your Cloud search head (if on the Victoria experience) or a on-prem heavy forwarder.  Using the IDM requires asking Splunk Support to install an appropriate app for you.  The other solutions are self-service.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

PA1
Builder

@aman35 you could poll the data using REST API by building a custom-addon using splunk add-on builder or if these logs are writing to a file, you could monitor/read it by installing a splunk agent .

Coming to splunk cloud, splunk cloud SH provides universal forwarder crdentials package..

If you are using UF approach, you need to download these credentials and place it on the splunk UF @/opt/splunkforwarder/etc/apps location and create a gitlab app with inputs.conf and deploy it to the same location and perform a splunk restart.

 

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...