All Apps and Add-ons

Splunk Add-on for Google Cloud Platform: How is the data coming?

alanzchan
Path Finder

I recently installed and configured this TA. For the configurations portion, only a JSON key from a GCP service account is needed; Splunk will then automatically scan for GCP projects and subscriptions. After selecting the desired project and subscriptions, Splunk is indexing data.

How exactly does this work? I was expecting there would be some firewall rules/ports that need to be configured before external data could be indexed.

0 Karma
1 Solution

timonix
Explorer

It is utilizing publically accessible GCP API and a service account with permissions to access that API setup on the desired project.

View solution in original post

0 Karma

sathwikr076
Communicator

@alanzchan can you please let me know where did you do all these configuration on search head or on indexer.

Thanks.

0 Karma

tyron_
Explorer

You should log this as a new question. But the answer is: neither. You should install the add-on on the heavy forwarders for data collection. Please refer to: https://docs.splunk.com/Documentation/AddOns/released/GoogleCloud/installation

sathwikr076
Communicator

Thanks for the reply.

0 Karma

timonix
Explorer

It is utilizing publically accessible GCP API and a service account with permissions to access that API setup on the desired project.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...