# Splunk

You can install the Splunk integration to post data to Moogsoft Enterprise when an alert occurs.

The Splunk integration does not support authentication options and security certificate bypass is not supported when the app is in the default SSL mode.

## Before You Begin

The Splunk integration has been validated with Splunk v6.5, 6.6, 7.1, 7.2 and 7.3. Before you start to set up your integration, ensure you have met the following requirements:

• You have an active Splunk account.

• Splunk can make requests to external endpoints over port 443.

## Configure the Splunk Integration

To configure the Splunk integration:

1. Navigate to the Integrations tab.

2. Click Splunk in the Monitoring section.

3. Provide a unique integration name. You can use the default name or customize the name according to your needs.

The Add-On uses the Splunk search to fetch data from Splunk and send it to Moogsoft Enterprise. If you are installing the Add-On in a distributed deployment, you only need to do so on the search head.

1. Install the add-on from Apps in the console or from Splunkbase, the Splunk marketplace.

If using on-premises versions of Splunk and Moogsoft Enterprise, copy the server.pem file to <splunk_home>/etc/apps/TA-Splunk-Moogsoft/bin.

### Note

You can also store or copy a Moogsoft Enterprise certificate in <splunk_home>/etc/apps/TA-Splunk-Moogsoft/local.

To do this, configure the relative path in the 'Moogsoft Certificate Path' with '../local/server.pem'.

2. Configure the triggers for Splunk alerts to be forwarded to the integration as follows:

Field

Value

URL

<url of the integration>

For example: https://<localhost>/events/splunk_lam_splunk1

Enter a severity. Clear, Indeterminate, Minor, Major, Critical.

Moogsoft Enterprise Certificate

Enter your certificate location if using an on-premises version of Moogsoft Enterprise and Splunk. Otherwise leave empty.

3. Save the changes.

After you complete the configuration, Splunk sends new alerts to Moogsoft Enterprise.