Is any questionnaire available which we will send to customer for input gathering specific to Custom Integrations.

[sayash27]

Is any questionnaire available which we will send to customer for input gathering specific to Custom Integrations.

[WalshyB]

I haven't seen one online, but some of the key questions you would want to ask would be..

Application Name - So that you can give a relevant name to the index

Use case - what are they looking to get out of Splunk

Method of Collection - (Can a Universal Forwarder be installed at the location the logs reside?, Syslog, API?)

Log Path (Universal Forwarder Collection) - Path logs reside (Does the splunk role (if splunk role is running splunk) have access to read that file)

Network - Do any ports need to be opened to get the flow in place?

License Usage - Predicted volume of onboarding so that you can plan the license accordingly

Access Limitations - Does access to these logs need to be restricted to a specific team and will it need to be segregated? (e.g. LDAP integration)

Sample Events - obtain a few sample events so that you know how to parse the data and whether any extractions can be done.

These are just some I can think off the top of my head, hope it helps 🙂

[sayash27]

Thanks WalshB for the sharing this 🙂

[woodcock]

You mean like a data onboarding survey?

[sayash27]

Yes like what all information we require before onboarding any device. So that we can plan according to that.

[adonio]

seen many different formulas...
try and map the data sources and that will give you a very good starting point