Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Code42 for Splunk
SHA256 checksum (code42-for-splunk_305.tgz) 53d208c76d0aeec249400a009a0c527e0d692a4547f361e18bf22baff0adb04e
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

Code42 for Splunk

Splunk AppInspect Passed
Code42 For Splunk integrates Splunk and Code42 to provide robust correlation of endpoint and backup data.

Table of Contents


  • About Code42 App For Splunk
  • Release notes
  • Performance benchmarks
  • Support and resources


  • Hardware and Software Requirements
  • Installation steps
  • Deploy to a Single Server Instance
  • Deploy to a Distributed Deployment
  • Deploy to a Distributed Deployment with Search Head Clustering
  • Deploy to Splunk Cloud


  • Data types
  • Lookups
  • Configure Code42 App For Splunk
  • Troubleshooting
  • Upgrade


About Code42 App For Splunk

About Code42 App For Splunk
Developer Aplura, LLC
App Version 3.0.5
App Build 114
TA TA-Code42ForSplunk , https://splunkbase.splunk.com/app/3746
IA IA-Code42ForSplunk , https://splunkbase.splunk.com/app/3747
Folder Name Code42ForSplunk
Vendor Products Code42 Enterprise/Small Business
Has index-time operations true
Create an index false
Implements summarization false

Code42 Integration with Splunk allows visibility into aspects of Code42.

Scripts and binaries
  • bin/code42.py
    • The base class used by the Modular Input to setup the code42_clients objects.
  • bin/code42_clients.py
    • The Modular Input class used to communicate and consume the API data.
  • bin/Diag.py
    • The class collects diagnostic information for the Modular Input.
  • bin/ModularInput.py
    • The Modular Input Class to consume and populate Splunk with data.
  • bin/RESTClient.py
    • The REST Client Base Class to interact with the Code42
  • bin/Utilities.py
    • This class provides administrative interactions to the Splunk platform.

Release notes

These are the issues that were closed for version 3.0.3.

  • Bug

    • [C42-53] - Force HTTPS

These are the issues that were closed for version 3.0.2.

  • Bug
    • [C42-51] - Modular Input Pagination

These are the issues that were closed for version 3.0.1.

  • Bug
    • [C42-48] - App Certification Failure

These are the issues that were closed for version 3.0.0.

  • Bug

    • [C42-27] - Track Cursor with SecurityDetectionEvents in Checkpoint
    • [C42-28] - Security Events Not Indexed at time of incident
    • [C42-29] - Dashboard Restore Forensics Username Dropdown
    • [C42-30] - Macro Error on Removable Media and Cloud Service Page
    • [C42-32] - TypeError Decoding Checkpoint IDs
  • New Feature

    • [C42-2] - Modular Input
    • [C42-3] - Application Configuration
    • [C42-4] - Documentation
    • [C42-5] - Branding Icons
    • [C42-6] - Checklist / Health Checks
    • [C42-7] - Dashboard - Instance
    • [C42-8] - Dashboard - Restore Forensics
    • [C42-9] - Dashboard - Cloud Service
    • [C42-10] - Dashboard - Removable Media
    • [C42-11] - Dashboard - Security
    • [C42-14] - Create CIM Fields for Data
    • [C42-18] - Eventgen
    • [C42-19] - Dashboard - Files Opened
  • Task

    • [C42-31] - Dashboard - Add Size and Count Breakdowns to Security Dashboards
    • [C42-33] - Dashboard - Overview Add CtC Panel
    • [C42-34] - Dashboard - Instance Restore
    • [C42-46] - Modify Server Alert Panels on Overview Dashboard
  • Improvement

    • [C42-20] - Dashboard - Security Enhancements
    • [C42-21] - Dashboard - Removable Media Enhancements
    • [C42-23] - Dashboard - Restore Enhancements
    • [C42-24] - Dashboard - Cloud Service Enhancements
    • [C42-25] - Update Modular Input to use kvstore (ifconfigured) for checkpoints
    • [C42-26] - Update Modular INput to use string.printable encoding of security event idsn
    • [C42-37] - Overview changes
    • [C42-38] - Instance -> Device Overview
    • [C42-39] - Instance -> Device Status Report
    • [C42-40] - Instance -> Device Restore Forensics
    • [C42-41] - Security -> Security Overview
    • [C42-42] - Security -> Removable Media
    • [C42-43] - Security -> Cloud Service
    • [C42-44] - Security -> Restore Forensics
    • [C42-45] - Security -> File Upload
About this release

Version 3.0.5 (114) of Code42 App For Splunk is compatible with:

Item Value
Splunk Enterprise versions 6.6, 7.0
CIM 4.8, 4.9
Platforms <platform independent="">
Vendor Products Code42 Enterprise / Small Business
New features

Code42 App For Splunk includes the following new features:

  • Ability to query Code42 APIs and pull relevant data.
Known issues
  • The installation file for the Input Add-on for Code42 App For Splunk is missing the props.conf and transforms.conf files in the default folder. As a workaround you can pull these files from the TA-Code42ForSplunk/default/props.conf and TA-Code42ForSplunk/default/transforms.conf or install the TA-Code42ForSplunk app on the IA.
Support and resources

Questions and answers

Access questions and answers specific to Code42 App For Splunk at https://answers.splunk.com.


Please visit https://answers.splunk.com, and ask your question regarding Code42 App For Splunk. Please tag your question with the correct App Tag, and your question will be attended to.


Software requirements

To function properly, Code42 App For Splunk requires the following software:

  • Splunk 6.6, 7.0
  • Code42 API Access

Splunk Enterprise system requirements

Because this add-on runs on Splunk Enterprise, all of the Splunk Enterprise system requirements apply.


Download Code42 App For Splunk at https://splunkbase.splunk.com/app/3736.

Installation steps

Deploy to single server instance

Follow these steps to install the app in a single server instance of Splunk Enterprise:

  1. Download the Code42 App For Splunk package from https://splunkbase.splunk.com.
  2. Install the App via the recommended installation methods (CLI, Web GUI)
  3. Restart Splunk.
  4. Configure the Modular Input with the required settings.

Deploy to distributed deployment

Install to search head

  1. Download the Code42 App For Splunk package from https://splunkbase.splunk.com.
  2. Install the App via the recommended installation methods (CLI, Web GUI, Deployment Server)
  3. Do NOT configure a Modular Input, unless there is only 1 (one) single Search Head.

Install to indexers

  1. Download the TA-Code42ForSplunk package from https://splunkbase.splunk.com.
  2. Install "TA-Code42ForSplunk" onto the indexers per your environment.

Install to universal forwarders

  1. There is no installation to Universal Forwarders.

Install to Heavy Forwarders
1. Download the IA-Code42ForSplunk package from https://splunkbase.splunk.com.
1. Install "IA-Code42ForSplunk" onto a heavy forwarder in your environment.
1. Configure the Modular Input with the required settings.

Deploy to distributed deployment with Search Head Clustering
1. Place the App into the "deploy_apps" folder on the Deployer Server.
2. Follow the instructions to install to a Heavy Forwarder. This Step is REQUIRED in a clustered SH environment!
3. Deploy the App to the Search Head Cluster. DO NOT install "IA-Code42ForSplunk" to the Cluster!

Deploy to Splunk Cloud

  1. Instruct the Splunk Cloud Support team to follow the instructions above that matches the Cloud environment.


Data types

This app provides the index-time and search-time knowledge for the following types of data:

  • Code42 API data


Code42 App For Splunk contains no lookup files.

The following lookup files are generated automatically from saved searches every hour.


Event Generator

Code42 App For Splunk does make use of an event generator. This allows the product to display data, when there are no inputs configured.

  • code42_org.eventgen
  • code42_security.eventgen
  • code42_computer.eventgen
  • code42_restore.eventgen
  • code42_user.eventgen
  • code42_alertlog.eventgen

Configure Code42 App For Splunk

  • Install the App according to your environment (see steps above)
  • Navigate to "App > Code42 App For Splunk > Administration > Application Configuration"

Application Configuration Dashboard

To configure the Code42 application you should start on the Application Configuration page ("Administration > Application Configuration")*[]:

Application Configuration

On this screen you can set the base index as well as a flag that specifies that the application is configured. In the future there will be additional configurations available.

Proxy Configuration

If you have configured a proxy server you can view the configuration under this tab. These are proxy server configurations that are being used by existing modular inputs for the Code42 application. You can also delete existing proxy configurations on this tab.

Encrypted Credentials

You can view/delete existing credentials on this tab. These are credentials that are being used by existing modular inputs in the Code42 application. These credentials are the credentials used to connect to Code42 appliances.


On this screen you can view and make any changes to existing modular inputs. As you make changes and tab between fields the modular input is modified.

Creating New Proxy Configurations

If you need to use a proxy as part of the connection to the Code42 appliance configure it here.

  • To create a new proxy server configuration, click the Create New Proxy button and fill in the following fields:
    • Proxy Name: Name for the proxy configuration. This name will be used as the proxy name in the modular input configuration.
    • Host: Proxy host name or IP.
    • Port: Port used to connect to the proxy server.
    • Username: Username used to connect to the proxy server.
    • Password: Password for the username specified above.
    • Use SSL: Should SSL be used for the proxy configuration?

Creating New Credentials

By default creating a new modular input with a username and password specified will create the necessary encrypted credentials. However if you want to create encrypted credentials manually follow this process:

  • To create a new encrypted credential, click the Create New Credential button and fill in with the appropriate username and password.
  • The realm is the application name where the encrypted credential is created + the username.

NOTE: By default creating a new modular input will automatically create a new encrypted credential so this process is not necessary unless you need a new credential for another purpose.

Creating New Code42 Inputs

NOTE: You will need to configure a new modular input for each appliance

  • To create a new data input, click the Create New Modular Input button and fill in the following fields. Those with a red asterisk on the screen are required.
  • Modular Input Name: Name for the data input configuration.
  • Hostname and port: The hostname or IP address and port of the Code42 appliance. By default you can specify hostname:443.
  • Username: The username used to connect to the appliance.
  • Password: The password for the previously specified username.
  • Toggle all data keys: Check to select all data keys.
  • Data keys: List of endpoints available on the Code42 appliance. Check the data key if you wish to pull event data.
  • Interval: The number of seconds indicate how often the input will poll for new data. This setting must be at least 60.
  • Index: This sets the index for data to be written to. This setting should be changed from default, which normally writes to the main index, to a specified index for best performance.
  • Use Proxy: Indicates if a proxy should be use for communication with the Code42 appliance.
  • Proxy Name: Enter the name of the proxy stanza to use with the input.

  • After creating the modular input you will need to disable/re-enable the input in "Settings > Data Inputs > Code42 App For Splunk" to activate the input.

NOTE: When configuring the modular input through the Application Configuration dashboard, the password is automatically encrypted into the credential store. If you need to change the credential, create a new credential, and reference the host/user pair in the modular input configuration. An encrypted credential is required for this Splunk App.


By default all events will be written to the "main" index. You should change the index in the configuration files to match your specific index.


  1. Summary Indexing: No
  2. Data Model Acceleration: No
  3. Report Acceleration: No

Troubleshoot Code42 App For Splunk

The best place to start troubleshooting Code42 App For Splunk is using this search:


Upgrade Code42 App For Splunk

Upgrade Code42 App For Splunk by re-installing into your environment per Splunk Documentation and your environment (see steps above).

Third-party software attributions

Version 3.0.5 (114) of Code42 App For Splunk incorporates the following third-party software or libraries. See README in app for full list.

Release Notes

Version 3.0.5
Nov. 30, 2017

Changes for App Certification


Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 50GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2018 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.