The Add-on imports and enriches data from the Netskope API, creating a rich data set ready for direct analysis, or use in an App. The Netskope Add-on for Splunk will provide the following functionalities:
- Collect data from Netskope via REST endpoints and store it in Splunk indexes.
- Categorize the data in different sourcetypes.
- Parse the data and extract important fields.
Latest Version: 4.5.0
Compatible with:
- Prerequisites: Netskope API Token for data collection
- Splunk Enterprise/ Cloud version: 10.4, 10.3, 10.2, 10.1, 10.0, 9.4
- Python version: Python 3.7 and Python 3.9
- OS: Platform independent
- Browser: Google Chrome, Firefox
Download
Download the Netskope Add-on For Splunk at https://splunkbase.splunk.com/app/3808/
Recommended System Configuration
Refer to the Splunk Enterprise system requirements: [Splunk Enterprise system requirements]
Topology and Configuring the Splunk Environment
This Add-On can be configured in two ways:
Standalone Mode: Install the Add-on app on a single machine. This single machine would serve as a Search Head + Indexer + Heavy forwarder for this setup.
Distributed Environment: Install Add-on on search head and Heavy forwarder (for REST API).
* Add-on resides on the search head machine and does not require any configuration here.
* Add-on needs to be installed and configured on the Heavy forwarder system.
* Execute the following command on Heavy Forwarder to forward the collected data to the indexer.
$SPLUNK_HOME/bin/splunk add forward-server <indexer_ip_address>:9997
* On the Indexer machine, enable event listening on port 9997 (recommended by Splunk).
* Add-on needs to be installed on the search head for CIM mapping.
Note that $SPLUNK_HOME is the absolute path where Splunk is installed.
Important
Important Note for Web Transaction Logs
Webtxn will be deprecated in a future release due to the planned deprecation of Google Cloud Pub/Sub Lite, which is currently used to collect Webtxn data.
As a result, Webtxn functionality will no longer be supported once this change takes effect.
If you are currently using Webtxn or planning to use it, please contact your Netskope Account Team for guidance on timelines, impact and available options to continue accessing Webtxn capabilities moving forward.
We recommend reaching out as soon as possible to ensure a smooth transition.
- Generate a Netskope API Token
- Installation and Upgrade of the Netskope Add-on for Splunk
- Configure the Netskope Add-on Account
- Configure Data Inputs
- Configure Add-on Settings
- Known Issues with the Netskope Add-on for Splunk
- Troubleshooting the Netskope Add-on for Splunk
- Netskope Add-on for Splunk Release Notes
- Reporting a Case with Netskope Support