icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Splunk App for Nextcloud
SHA256 checksum (splunk-app-for-nextcloud_261.tgz) 1aa5170247b527484756d3480f65b0e21ffbded38e8102295638cf8e62e22b80 SHA256 checksum (splunk-app-for-nextcloud_250.tgz) 0e022c4713d3ff3ce1a9d6bd1d123a7c1b8f6007c60e995684f096a0f0809412 SHA256 checksum (splunk-app-for-nextcloud_242.tgz) 47936cc67b2a47a4a8f15aab620b6a8a84e51a439d6017368b86bcde2a96b346 SHA256 checksum (splunk-app-for-nextcloud_230.tgz) c108bff94b385e8eaa2e35eba0686ad0b943bd4fbdd3229683a1455c261f938e SHA256 checksum (splunk-app-for-nextcloud_220.tgz) df4482e50f5bc17343df399c50c0f2dcabf380e28113d18588a4be5c681ef60c SHA256 checksum (splunk-app-for-nextcloud_210.tgz) 7c160d9eab0860af0bdb8aa5721ef8edd4c611c2a52db0534af3e873a74cdc65 SHA256 checksum (splunk-app-for-nextcloud_200.tgz) 5d052e268c8cd73edce9ee39c7e43e6f9a142d15c0e8460d11fbeef6b26828a9 SHA256 checksum (splunk-app-for-nextcloud_100.tgz) 28ea60896854b1d65047fac650a9068e64d4ac4a70f2356ed0141dff272569c0
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

Splunk App for Nextcloud

Splunk AppInspect Passed
Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Nextcloud (http://nextcloud.com) is an open source self-hosted file sync and share solution. The “Splunk App for Nextcloud” visualises Nextcloud data collected from Nextcloud generated log files and from Nextcloud monitoring endpoints.

Splunk App for Nextcloud

The “Splunk App for Nextcloud” visualises Nextcloud (http://nextcloud.com) data collected from Nextcloud generated log files and from Nextcloud monitoring endpoints collected by the “Nextcloud Add-on for Splunk”.

An Install Guide can be downloaded here:

The following information is presented in dashboards:
* Current status of the Nextcloud server (available, in maintenance, web server down, host unavailable).
* Status breakdown for time period.
* Successful and failed logins and ratio of the same.
* Number of defined and active users.
* Number of total shares and number of file operations.
Nextcloud System Information.
* Information about current Nextcloud server configuration.
* Timeline of Nextcloud server upgrades.
* Number of defined and active users.
Shares and Storage.
* Number of shares, federated shares, files and free disk space.
Sharing actions.
* Who has shared (or unshared) what, with whom, how (public, user or group shares) and when.
File and Folder Activity.
* What file or folder operations have been performed by whom, when, from where. Ability to filter the file and folder activity by country and/or user.
Public File Access.
* What has been accessed via public shares, when and from where.
Hardware information.
* CPU load averages, free and used memory, database size.
User/Group Operations.
* When and by whom were users created or deleted, disabled or enabled, added or removed from groups, groups created or deleted.
Password Changes.
* Who has or have had had their password changed, who changed it and from where. What password reset attempts have there been.
User Login Activity.
* Login activity over time and by location. Full login activity audit trail. Ability to filter the login activity by country and/or user.
Failed Logins.
* Failed logins shown from external and from internal IP addresses, over time and by user.
File, Folder and User Audit.
* Complete file and folder audit trail providing answers to questions such as "what file operations did user X perform when?" or "who did what to file Y when?" or "when did user X do something to file Y?
Virus Detection.
* Statistics and information from the "Anti-virus for files" app for Nextcloud.

NOTE: Since Nextcloud v14, data is written to two separate log files, the nextcloud.log file and the audit.log file. Most of the data visualised by this app is in the audit.log file. Therefore if you have upgraded your Nextcloud server to v14 you will find that the app is no longer visualising data and you need to also ingest the audit.log file.

Release Notes

Version 2.6.1
Sept. 16, 2019

-Two new dashboards:
-"Sharing Actions"
Shows any sharing actions performed by users. for example when a user shares a file or folder via a public link.
-"User/Group Operations"
Shows any users created or deleted, groups created or deleted, users added or removed from groups, users enabled or disabled + some statistics around the distribution, time and location of the operations.
Note: a Nextcloud "feature" means that your Nextcloud server needs to be v15.0.11 or higher to show users enabled.
-Fixed SPL query bug which caused the "Current Status" panel to not always show the correct status

Version 2.5.0
July 9, 2019

-Layout of "Overview" dashboard changed (sorry) and additional dashboard panels displaying information about successful vs failed logins.
-New “Public File Access” dashboard. See information about files shared with the Nextcloud "Share link" feature.
-Several dashboards have additional dropdown filters.
-The beginnings of CIM compatibility. Authentication model done, change model almost done.

Version 2.4.2
May 30, 2019

“Overview” dashboard:
-Trends are now shown as percentages instead of actual values.
-Drill-down fixed.
“File & FolderActivity” dashboard:
-One can now choose a file operation type.
-The “by country” dashboard panel no longer only shows clients accessing the Nextcloud server from a public IP address. Although it isn’t a country, if internal users are using a private IP address, the country is shown as “-internal-“.
“Password changes” dashboard:
-Additional panel added showing password reset attempts.
“Failed Logins” dashboard:
-Several panels now also shown the user name that was used when the failed login occurred.
“File, Folder and User Audit” dashboard:
-Now also shows the IP address.
“User login activity” dashboard:
-Fixed “Top users by login country” to use the time chosen with the time picker.
“Virus detection” dashboard:
-The format of some messages from the Nextcloud Anti-virus app has changed, both formats now accepted.

2.4.0 and 2.4.1 not available due to developer errors

Version 2.3.0
Nov. 19, 2018

Additional dashboards:
-User login activity
-App debugging

Version 2.2.0
Nov. 12, 2018

-New “Virus detection” dashboard. The "Anti-virus for files" app for Nextcloud must be installed for this dashboard to populate.
-Added the ability to enter a user name in the “File & Folder Activity” dashboard.
-Added more information to the “Nextcloud System Information” dashboard
-Added information to the “Overview” dashboard.
-Changed the default time period from 24 hours to “Last 7 days” in all dashboards.
-Alert configured for when Nextcloud reports that any Nextcloud apps can be updated. You will most likely want to edit the alert action to alert you via email, pushover, slack or whatever alert action is relevant for you.
-New App icon!

Version 2.1.0
June 19, 2018

Change of menu layout and additional dashboards:
-Nextcloud System Information
-Password changes
-Failed logins
-File, folder and user audit
-Although not a new dashboard, the "File & Folder Activity" dashboard contains additional panels.

Version 2.0.0
May 16, 2018

-Additional dashboard for visualising file and folder activity derived from nextcloud.log.
-Configuration to ensure multi-line XML and JSON ingests are always ingested as one event.
-Name change

Version 1.0.0
Dec. 1, 2016


Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2020 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.