Configure

Splunk Configuration

For the TSS Console and the TSS API to send their audit data to Splunk, configure the Splunk Server as follows :

1.Enable HTTP Event Collector (HEC): Settings > Data inputs > HTTP Event Collector > Global Settings > Enabled.*

2.Configure a new token for receiving data over HTTP: Settings > Data inputs > HTTP Event Collector > New token. Make also sure the token is Enabled (Status). *

3.(Optional) Change the dedicated port for HTTP input: Settings > Data inputs > HTTP Event Collector > Global Settings > HTTP Port Number. Default value is 8088.*

* The path may vary depending on the Splunk version.

TSS Configuration

The following TSS settings are required to use Splunk as the solution to save audit data.

Enable/Disable Splunk as the Audit system

Location: TSS Settings
Audit	Send audit data to Splunk truefalse Key: audit.splunk.enable Description: Defines if the audit data are sent over HTTP (or HTTPS) directly to Splunk Enterprise or Splunk Cloud. If set to true, audit data are sent to Splunk, otherwise they are saved into database. Constraint: true|false Related settings: Purge Audit Delay (audit.purge.delay) Enable audit system (audit.enable) Splunk server URI (audit.splunk.server.uri) Splunk HTTP event collector authorization token (audit.splunk.hec.token) Splunk batch interval in milliseconds (audit.splunk.batch.interval) Splunk batch maximum number of audit data (audit.splunk.batch.sizeCount) Splunk batch max size (audit.splunk.batch.sizebytes)

Splunk server base URI

The Splunk server URI must be the base URI pointing to the server. Accepted protocols are HTTP and HTTPS. The port sub-component is required if its value is different from 80. The default port is 8088 and must be specified if it has not been changed.

Location: TSS Settings
Audit	Splunk server URI Key: audit.splunk.server.uri Description: Defines the base URI of the Splunk server where audit data may be sent. Constraint: String, must be the base URI pointing to the server. Accepted protocols are HTTP and HTTPS. The port subcomponent is optional. Example: https://localhost:8088 The TSS completes this value to generate the necessary URIs Related settings: Purge Audit Delay (audit.purge.delay) Enable audit system (audit.enable) Send audit data to Splunk (audit.splunk.enable) Splunk HTTP event collector authorization token (audit.splunk.hec.token) Splunk batch interval in milliseconds (audit.splunk.batch.interval) Splunk batch maximum number of audit data (audit.splunk.batch.sizeCount) Splunk batch max size (audit.splunk.batch.sizebytes)

Splunk HTTP event collector authorization token

The HTTP Event Collector (HEC) token is the one created in Splunk server and must be enabled.

Location: TSS Settings
Audit	Splunk HTTP event collector authorization token Key: audit.splunk.hec.token Description: Defines the HTTP Event Collector (HEC) token used to authenticate the audit data that Splunk server receives. If the token sent along with a given request doesn't match one of its allowed tokens, HTTP Event Collector doesn't allow Splunk Enterprise or Splunk Cloud to consume the data. Constraint: String, HTTP Event Collector tokens are globally unique identifiers (GUIDs) that the Event Collector generates. Related settings: Purge Audit Delay (audit.purge.delay) Enable audit system (audit.enable) Send audit data to Splunk (audit.splunk.enable) Splunk server URI (audit.splunk.server.uri) Splunk batch interval in milliseconds (audit.splunk.batch.interval) Splunk batch maximum number of audit data (audit.splunk.batch.sizeCount) Splunk batch max size (audit.splunk.batch.sizebytes)

Optional settings

The following settings are optional and can be used to activate the batching options (off by default) that allows to decrease number of HTTP requests to Splunk server.

batch interval in milliseconds

Location: TSS Settings
Audit	Splunk batch interval in milliseconds Key: audit.splunk.batch.interval Description: Batch interval controls a timer (in milliseconds) that forcefully sends events batch regardless of its size. The batching allows to decrease number of HTTP requests to Splunk server and is controlled by three parameters (which can be combined): 1) batch size count 2) batch size bytes 3) batch interval Audit data batching is off by default. Constraint: Positive integer. Zero value means that the batching parameter is off. Related settings: Purge Audit Delay (audit.purge.delay) Enable audit system (audit.enable) Send audit data to Splunk (audit.splunk.enable) Splunk server URI (audit.splunk.server.uri) Splunk HTTP event collector authorization token (audit.splunk.hec.token) Splunk batch maximum number of audit data (audit.splunk.batch.sizeCount) Splunk batch max size (audit.splunk.batch.sizebytes)

batch max size in bytes

Location: TSS Settings
Audit	Splunk batch max size Key: audit.splunk.btach.sizebytes Description: Defines the batch maximum size in bytes for the audit data inside one HTTP request. The batching allows to decrease number of HTTP requests to Splunk server and is controlled by three parameters (which can be combined): 1) batch size count 2) batch size bytes 3) batch interval Audit data batching is off by default. Constraint: Positive integer Zero values for the batching params mean that batching is off. Related settings: Purge Audit Delay (audit.purge.delay) Enable audit system (audit.enable) Send audit data to Splunk (audit.splunk.enable) Splunk server URI (audit.splunk.server.uri) Splunk HTTP event collector authorization token (audit.splunk.hec.token) Splunk batch interval in milliseconds (audit.splunk.batch.interval) Splunk batch maximum number of audit data (audit.splunk.batch.sizeCount)

batch maximum number of audit data

Location: TSS Settings
Audit	Splunk batch maximum number of audit data Key: audit.splunk.batch.sizeCount Description: Defines the maximum number of audit data sent in batch inside one HTTP request. The batching allows to decrease number of HTTP requests to Splunk server and is controlled by three parameters (which can be combined): 1) batch size count 2) batch size bytes 3) batch interval Audit data batching is off by default. Constraint: Positive integer Zero value means that the batching parameter is off. Related settings: Purge Audit Delay (audit.purge.delay) Enable audit system (audit.enable) Send audit data to Splunk (audit.splunk.enable) Splunk server URI (audit.splunk.server.uri) Splunk HTTP event collector authorization token (audit.splunk.hec.token) Splunk batch interval in milliseconds (audit.splunk.batch.interval) Splunk batch max size (audit.splunk.batch.sizebytes)