Splunk Add-on for Google Cloud Platform
Overview
Details
After the Splunk platform indexes the events, you can analyze the data using the prebuilt panels included with the add-on. You can then directly analyze the data or use it as a contextual data feed to correlate with other Google Cloud-related data in the Splunk platform.
Documentation for this add-on is posted at Splunk Docs.
Release Notes
Version 3.1.1
Added native support for Cloud Storage - Usage log format. Previously this data was ingested in the generic google:gcp:buckets:*data sourcetype.
UI component upgrades for compatibility with future versions of the Splunk software (jQuery removal).
The billing API used to fetch billing data is now deprecated. Users won't be able to ingest billing data using the billing input.
Self-Service restart fix. Rolling restarts have been eliminated.
The sourcetype: google:gcp:buckets:accesslogs, which has been configured to work with the Change data model in the Common Information Model (CIM).
Improved CIM support for storage access events.
Line breaking fix - ADDON-27084
3rd party lib upgrades - urllib3 & httplib2
Version 3.0.2
Improved Support for the Assets and Identities CIM Model.
Improved Support for the Network Traffic Data Model.
Version 3.0.1
This release for Splunk Add-on for Google Cloud Platform adds:
Improved Support for the Authentication CIM Model.
Improved Support for Gsuite logs with Authentication CIM Model.