Splunk Splunk pimC

< integrations

This page documents the enPortal integration for Splunk Splunk.

If you are using portal version 5.3 or earlier please click here for the integration documentation applicable to it

  • Vendor: Splunk
  • Product: Splunk
  • Supported Version(s): 6.0
  • Name of enPortal Integration Package: splunk.splunk_pimC
  • Required enPortal Version: 4.6.1 and above


The following section documents supported platforms, installation, and configuration of the Splunk Product Integration Module on enPortal versions 4.6.1 and above.

Page Contents

1. Support Matrix

The following Operating System, Database, and Web Browser platforms are supported:


1.1. Operating System

Please see the list of supported Operating Systems on the System Requirements page.


1.2. Database

A special database is not required to implement this integration module. The AppBoard/enPortal database is used to store all configurations related to this integration module.


1.3. Web Browser

Please see the list of supported Web Browsers on the System Requirements page.


2. Installation

Perform the following steps to install the Splunk PIM:

  1. Install AppBoard/enPortal as detailed in the Installation documentation
  2. Download the file splunk.splunk_pimC.jar
  3. Start enPortal and login as a portal administrator
  4. Under the Web Integrations tab, select PIM Import
  5. Click the Browse... button
  6. Locate the file splunk.splunk_pimC.jar in the Open dialog
  7. Click the Start button to extract the files from the PIM .jar archive
  8. Confirm that the following messages are displayed:
    1. "Upload completed."
    2. "Loaded the following file(s): load_splunk.splunk_pimC.txt"
    3. "CRS cache cleared."

3. Integration Details

The following sections provide special details for configuring the integration module after installation.


3.1. Channel Types

  • Home - Channel that displays the default Home page for the logged in user, including full navigation controls (no custom configuration required)
  • Proxy - Channel that is used by the system to display Splunk channels (no custom configuration required)
  • Application - An application of Splunk.
The URI value is /en-US/app/${shim:channel.field.applicationName}.
Available applicationName:
search
More can be added if more applications are installed.
  • Search Application - Splunk's search application functions.
The URI value is /en-US/app/search/${shim:channel.field.applicationName}.
Available applicationNames:
alerts
charting
dashboards
index_status
index_status_health
indexing_volume
inputs_status
pdf_activity
pivot
reports
scheduler_savedsearch
scheduler_status
scheduler_status_errors
scheduler_user_app
search
search_detail_activity
search_status
search_ui_activity
search_user_activity
splunkd_status
splunkweb_status
More can be added if more applications are installed.
  • SavedSearch - Splunk's Saved Search page.
The URI value is /en-US/app/search/%40go


3.2. Configuration

After installing the Splunk PIM, perform the following steps to configure access to the host Splunk server:

  1. Under the Web Integrations tab, select Applications & Licenses
  2. Right-click on the name sample in the row for Splunk (splunk.splunk_pimC) and select Modify
  3. Fill in the items in the Modify Application Wizard dialog:
    1. Select the protocol used to access your Splunk server (http or https)
    2. Change the host name from "changeme" to the hostname or ip address that will resolve to your Splunk server
    3. Change the port to the port number of your Splunk server
    4. Click "Save" to keep your changes
  4. Under the Web Integrations tab, select Explorer
  5. In the Explorer, under Packages, expand the cuculus.zonoscontrolcenter_pimA tree and click on the sample target. Confirm that the information you entered is displayed for your Splunk server
  6. Under the sample target, click on the Home channel. A login prompt should be displayed.
  7. Log in using the same credentials you would use for accessing the Splunk application in a browser. Confirm that the Splunk Home page is displayed.


3.3. Create Channels

After installing the Splunk PIM and configuring access to the host Splunk server, perform the following steps to create channels to display Splunk content:

  1. Under the Web Integrations tab, select Applications & Licenses
  2. Right-click on the name sample in the row for splunk.splunk_pimC and select a channel type
  3. In the "Channel Name" box, enter the name you want to give to the new channel
  4. Click Next
  5. Click Finish
  6. Under the Web Integrations tab, select Explorer
  7. In the Explorer, under Packages, expand the splunk.splunk_pimC tree and click on the sample target. Confirm that the new channel is listed along with the other sample channels

Repeat the above steps to create additional channels. Select a different Channel Type in step 2 to create a different type of channel.


3.4. Known Issues

The following known issues are associated with this PIM:

  • There are currently not any known issues associated with this PIM


3.5. License Usage

In order for the AppBoard/enPortal administrator to configure the splunk.splunk_pimC PIM, the AppBoard/enPortal license.properties file must include licensing for at least one splunk.splunk_pimC server. The administrator can create one additional host ("target") in AppBoard/enPortal for each server license included in the license file.

Each AppBoard/enPortal user maintains one user session with the Splunk server. The Splunk application must be licensed to support the number of users that will be accessing the application through AppBoard/enPortal.


3.6. Version Support

The following matrix details the supported Splunk and compatible AppBoard/enPortal versions:

Version Support
Package Name enPortal Version Splunk Supported Versions
splunk.splunk_pimC 4.6.1+ 6.0
To see the current enPortal version, run the portal version command from the [AppBoard_Home]/server/bin directory.

4. Upgrades

4.1. Upgrading from an older version

Older versions of Splunk are not supported by this PIM, so this upgrade path is not supported. It is recommended that you validate the PIM in your Splunk environment to confirm that it supports the required functionalities.


4.2. Upgrading to a newer version

Perform the following steps when the Splunk server is upgraded to a newer version of Splunk:

  1. Check the AppBoard/enPortal PIM online documentation to see if the new Splunk version is supported by the existing splunk.splunk_pimC PIM.
  2. Test if the new Splunk version is supported by the existing PIM that you have installed, perform the following steps:
    1. Under the Web Integrations tab, select Applications & Licenses
    2. Right-click on the row for the old Splunk server and select "Modify"
    3. Update the protocol, host, and port to reference the server where the new version of Splunk is running
  3. If the new Splunk version is not supported by the existing PIM that you have installed, perform the following steps to upgrade the PIM:
    1. Download the new PIM version from the PIM download site
    2. Follow the steps in the Installation section above to install and configure the new PIM version
    3. Re-create all Splunk channels to reference the new PIM
    4. [Optional] Perform the steps outlined in the Uninstall section below to remove the old PIM from the system


5. Uninstall

Perform the following steps to uninstall the splunk.splunk_pimC PIM:


Uninstalling the splunk.splunk_pimC PIM will break all of the channels in your AppBoard/enPortal system that reference this integration.
  1. Under the Web Integrations tab, select Explorer
  2. In the Explorer, under Packages, locate the splunk.splunk_pimC integration
  3. Right click on the integration name, and select "Delete"
  4. Click "Ok" to confirm that you want to delete the integration package