update to Splunk Add-on for Infoblox?

[ilhwan]

I'm struggling to get data in from Infoblox using Splunk Add-on for Infoblox.  I looked at the documentation and realized it doesn't support the current versions.  I'm using Infoblox NIOS 9.0.3.  The Splunk documentation says it supports Infoblox NIOS 8.4.4, 8.5.2, 8.6.2.

Specifically, it's not parsing correctly, and everything goes into sourcetype=infoblox:port.

Are there any more current ways to get data in from Infoblox?  Can I get Splunk support to help me since it's a Splunk-supported Add-on?

[tej57]

Hey @ilhwan,

I believe as of now Splunk Support will only be able to provide you with the roadmap on when they plan to add support for Infoblox NIOS 9.0.3. Also, the last version was published in 2022 and since they haven't planned a release, I doubt it's going to be anytime soon. However, you can publish the request on ideas.splunk.com and have it voted on high number to get their traction and probably develop a new release supporting newer version of Infoblox. 

Additionally, if the timeline is far away for the support and you have a use case, you can opt for developing a custom TA. If you enjoy scripting, you can definitely create new add-on using Splunk Add-on Builder and UCC framework. 

Thanks,
Tejas.

---

If the solution helps your use case, an upvote is appreciated..!!