For support and questions, please e-mail email@example.com
Splunk Enterprise version 8.x-7.x
Cloudflare logs are expected to be in JSON format with a sourcetype of cloudflare:json
For documentation on the available methods for collecting Cloudflare logs please refer to the Cloudflare Logs developer documentation here.
For ease of onboarding and integration, it is recommended to use Cloudflare’s Logpush Service to push logs to Amazon S3, which can then be pulled into Splunk using the Splunk Add-on for AWS. Instructions on how to install the Splunk Add-on for AWS and configure inputs can be found here – this link also contains details on where to install the Splunk Add-on for AWS as it is dependent on the type of deployment you have.
Please note that if you are performing the data onboarding from a separate instance of Splunk and not where the Cloudflare App for Splunk is located, it is strongly advised to copy the proper section of the props.conf packaged with the Cloudflare App for Splunk to the instance which is collecting the Cloudflare JSON data.
By default, within the application JSON key-value extraction is turned on at search time by setting KV_MODE in the props.conf packaged with the application to json. If you happen to set up INDEXED_EXTRACTIONS for the cloudflare:json sourcetype at the point of which you are onboarding data, then you will need you need to set KV_MODE=none in the props.conf packaged with the application to ensure field values are not extracted twice and thus impacting the dashboards.
The Cloudflare App for Splunk is easy to install and configure. Please follow the steps below to install and configure the application within your Splunk environment.
Ensure the Application Requirements documented above are met.
Download the application from Splunkbase.
Install the application on your Search Head or Search Head Cluster using standard application deployment methods. Information on installing applications on Splunk can be found in the Splunk documentation here.
Once installed the application needs to be configured. A Set Up page is bundled with the application. To configure the application following these steps:
Access the application on your Search Head by clicking on the “Cloudflare App for Splunk” from your Splunk launcher home page or from the Apps dropdown menu. You will be prompted with the application Set Up screen.
Enter the Index name where the Cloudflare JSON logs are stored. This value must be entered in the format index=index_name. By default the value is set to index=cloudflare
Choose whether to enable Data Model Acceleration. By default, acceleration is disabled.
The Index Name can be changed after initial configuration by accessing the App Set Up page by clicking on Apps dropdown > Manage Apps > Cloudflare Set Up. The Index Name can also be manually found by going to Settings > Advanced search > Search macro within the Cloudflare App for Splunk.
The Cloudflare App for Splunk comes with a custom Cloudflare Data Model which has an acceleration time frame of 1 Day but is not accelerated by default. If you enable Data Model acceleration it is recommended that the Data Model is only accelerated for 1 or 7 days to ensure there are no adverse effects within your Splunk environment. You can enable or disable acceleration after initial configuration by accessing the App Set Up page by clicking on Apps dropdown > Manage Apps > Set Up link to the right of Cloudflare. Data Models can also be manually configured by going to Settings > Data models. More information on data model acceleration can be found here.
Version 1.0.0 (May 10, 2019)
This is the initial release of the Cloudflare App for Splunk. Dashboards included within this release are broken up into
4 categories: Snapshot, Performance, Reliability and Security.
- Cloudflare – Snapshot (Web Traffic Overview)
- Cloudflare – Snapshot (Web Traffic Types)
- Cloudflare – Performance (Hostname, Content Type, Request Method, Connection Type)
- Cloudflare – Performance (Requests and Cache)
- Cloudflare – Performance (Bandwidth)
- Cloudflare – Performance (Static vs. Dynamic Content)
- Cloudflare – Reliability (Summary)
- Cloudflare – Reliability (Detailed)
- Cloudflare – Security (Overview)
- Cloudflare – Security (Bots Summary)
- Cloudflare – Security (Bots Detailed)
- Cloudflare – Security (Rate Limit)
- Cloudflare – Security (WAF)
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.