Getting Data In

How to ingest gitlab audit logs to Splunk?

aman35
Observer

Hi All, 

I am new to splunk. We are using splunkcloud and version 8.2. 

We are exploring how to ingest gitlab audit logs in splunk.

I checked gitlab project audit add on is not available in splunkcloud. I have tested HEC endpoints. For me my HEC working from curl https request. 

But I am clueless how can I ingest gitlab logs to splunk and keep this process realtime and automated.

Please suggest.

 

Thanks in advance.

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Doesn't gitlab simply produce log files? So you could just install a Universal Forwarder and ingest local files?

Just asking, don't know gitlab.

0 Karma

aman35
Observer

It does produce the log files.. But I never tried forwarder and ingestion. Can you please shed some light on it.

It will be great help if I can get some documentation about it. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

https://docs.splunk.com/Documentation/Splunk/latest/Data/Getstartedwithgettingdatain

---
If this reply helps you, Karma would be appreciated.
0 Karma

aman35
Observer

thank you @ricm @PickleRick . 

But I think splunkcloud does not use forwarders. it use IDM. we are using gitlab saas

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk Cloud uses forwarders and IDM.  IDMs are not available for all stacks.  However, all Splunk Cloud customers can use forwarders to get data from their on-prem servers to Splunk Cloud.

To get data from another cloud service, you can use an IDM (if available) or an input on your Cloud search head (if on the Victoria experience) or a on-prem heavy forwarder.  Using the IDM requires asking Splunk Support to install an appropriate app for you.  The other solutions are self-service.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Roy_9
Motivator

@aman35 you could poll the data using REST API by building a custom-addon using splunk add-on builder or if these logs are writing to a file, you could monitor/read it by installing a splunk agent .

Coming to splunk cloud, splunk cloud SH provides universal forwarder crdentials package..

If you are using UF approach, you need to download these credentials and place it on the splunk UF @/opt/splunkforwarder/etc/apps location and create a gitlab app with inputs.conf and deploy it to the same location and perform a splunk restart.

 

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...