Configure Data Inputs

The following sections explain how to configure various types of inputs.

Alerts

1. Go to the Inputs tab and click Create New Input in the upper-right, and then click Add Alerts (Iterator).
   
2. In the Add Alerts (Iterator) window, enter this information:
   • Name can be any unique name, but using <tenant-name>_alerts helps differentiate the input from _events and _clients, which will be created later.
   • Index can be left as default, unless you have custom indexes configured in Splunk.
   • Netskope Account should be the tenant account created previously.
   • The Start Date/Time and End Date/Time fields can be left blank. If configured, only events occurring after the specified Start Time and/or before the specified End Time will be fetched from Netskope. By default, if no End Time is provided, the Start Time is considered as the time when the input is configured, and events are collected from that point forward.
   • Alert Types can be left as All or individual alert types can be selected by clicking into the field.

     Note

     The All is a summarizing rolled-up endpoint for all alerts, hence it may not include all the alert fields. To get detailed alert information, please explicitly select individual alert-types.

   • Refine Data can only be configured if a single alert type is selected. An Alerts (Iterator) input would need to be created for each alert type that needs fields filtered. Enter comma separated fields to Include/Exclude.
3. Click Add and wait for the window to close. If there are any missing API token permissions, you will see an error with additional details, and the input will not be added. Fix the API token permissions, return to this page, and click Add again.

Events

1. Go to the Inputs tab, click Create New Input in the upper-right, and then click Add Events (Iterator).
   
2. In the Add Events (Iterator) window, enter this information:
   • Name can be any unique name, but using <tenant-name>_events helps differentiate the input from _alerts and _clients.
   • Index can be left as default, unless you have custom indexes configured in Splunk.
   • Netskope Account should be the tenant account created previously.
   • The Start Date/Time and End Date/Time fields can be left blank. If configured, only events occurring after the specified Start Time and/or before the specified End Time will be fetched from Netskope. By default, if no End Time is provided, the Start Time is considered as the time when the input is configured, and events are collected from that point forward.
   • Event Types can be left with all the event types selected. Click the x next to any event types that should not be fetched.
   • Refine Data can only be configured if a single event type is selected. An Events (Iterator) input would need to be created for each event type that needs fields filtered. Enter comma separated fields to Include/Exclude.
3. Click Add and wait for the window to close. If there are any missing API token permissions, you will see an error with additional details, and the input will not be added. Fix the API token permissions, return to this page, and click Add again.

Clients

1. Go to the Inputs tab, click Create New Input in the upper-right, and then click Add Clients (Iterator).
   
2. In the Add Clients (Iterator) window, enter this information:
   • Name can be any unique name, but using <tenant-name>_clients helps differentiate the input from _alerts and _events.
   • Index can be left as default, unless you have custom indexes configured in Splunk.
3. Click Add.

Events (Multi Iterator)

1. Go to the Inputs tab, click Create New Input in the upper-right, and then select Events (Multi Iterator).
2. In the Add Events (Multi Iterator) window, enter this information:
   • Name can be any unique name, but using <tenant-name>_<event-type> helps differentiate the input (like test_application or test_network).
   • Index can be left as default, unless you have custom indexes configured in Splunk.
   • Netskope Account should be the tenant account created previously.
   • Event Type must be selected from the available options:
     • Connection: Collects connection event data.
     • Application: Collects application event data.
     • Network: Collects network event data.

   Important

   Only one Events (Multi Iterator) input can be created per event type per Netskope Account. For example, you can only have one Application event iterator for a given tenant. If you attempt to create a second iterator for the same event type and tenant, you will receive an error and the input will not be created.

3. Click Add and wait for the window to close. If there are any missing API token permissions, you will see an error with additional details, and the input will not be added. Fix the API token permissions, return to this page, and click Add again.

Unlike the Events (Iterator) input, Events (Multi Iterator) collects only one event type per input configuration. To collect multiple event types, create a separate Events (Multi Iterator) input for each event type you need.

The Events (Multi Iterator) input is used to collect real-time event data (application, network, or connection events) from a Netskope tenant using the iterator API, ingesting the data as CSV into Splunk. It is designed for continuous, low-latency event collection where each input handles a single event type per tenant.