About klops

alacercogitatus · ‎07-23-2015

The domain lookup is still using a CSV lookup. It will be transitioned to KV Store on next release - thanks for pointing that out. In the meantime, if your domain list doesn't populate, make sure that the lookup folder is created and writable in $SPLUNK_HOME/etc/apps/GoogleAppsForSplunk .

klops · ‎05-29-2015

Answering my own question. We ended up using a simple nginx server setup to just relay all the https POST into log files, and have a generic splunk universal forwarder on the nginx host to send the log over. specific nginx setup is inspired by this stackoverflow post: http://stackoverflow.com/questions/4939382/logging-post-data-from-request-body

Drainy · ‎05-10-2012

Its quite easy to do and if you use the Universal Forwarder on your remote systems then you can do some more filtering before sending data on 🙂 Also if its helped then consider clicking the tick below the up and down arrow to the left of my answer, it will help others will similar problems in the future

Posts	7
Solutions	1
Karma Given	1
Karma Received	0
Member Since	‎11-29-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Can't find domain in default "Google Apps Event Su...

Heroku https drain to splunk enterprise

Why do I still get "Daily indexing volume limit ex...

Re: Can't find domain in default "Google Apps Even...

Re: Heroku https drain to splunk enterprise

Re: Why do I still get "Daily indexing volume limi...