Where to install this add-on

Unless otherwise noted, all supported add-ons can be safely installed to all tiers of a distributed Splunk platform deployment. See Where to install Splunk add-ons in Splunk Add-ons for more information.

This table provides a reference for installing this specific add-on to a distributed deployment of Splunk Enterprise.

Splunk platform component	Supported	Required	Comments
Search Heads	Yes	Yes	This add-on contains search-time knowledge.
Heavy Forwarders	Yes	No (but recommended)	It is recommended (but not required) that the HTTP Event Collector (HEC) be configured on a heavy forwarder. The add-on must be installed on whichever Splunk instance hosts the HTTP Event Collector (HEC).
Indexers	Yes	No (but recommended)	It is recommended (but not required) that the add-on be installed on indexers in case future versions of the app require additional index time operations.
Universal Forwarders	No	No	Universal forwarders are not supported for data collection because the data must be collected through an HTTP Event Collector (HEC).

Select or create a Splunk index

Pick an existing index for the data to be sent to, or configure a new index (e.g. “pki”) prior to the HTTP Event Collector (HEC) being configured.

Create HTTP Event Collector (HEC)

Select a Splunk instance to act as the data collection node. Ideally this is a heavy forwarder that can be accessed from the network PKI Spotlight is deployed in. For Splunk Cloud it is recommended that you create an HTTP Event Collector (HEC) on the ad-hoc Splunk Cloud search head (e.g. not Enterprise Security search head).

To create the HTTP Event Collector:

Login to Splunk as an admin user or other user with permission to create new data inputs

Settings > Data Inputs > next to “HTTP Event Collector” select “+ Add new”

Provide a descriptive name (this is just to delineate what this HTTP Event Collector is used for internally within Splunk) e.g. “PKI Spotlight” the remaining fields are optional.

o It is not recommended to override the “Source name” field.

o Indexer acknowledgement is not currently supported by PKI Spotlight

Click “Next” to advance the configuration

Next to “Source type” choose “Select” and type “pki” to select the “pki” sourcetype

o If you have not restarted Splunk since the add-on was installed, you may not see “pki” listed. It is recommended that you restart the instance to populate the name.

Choose your desired index (e.g. “pki”) set this as the “default” index.

o PKI Spotlight events do not include index so all events will be routed to the same destination unless additional Splunk configurations are put in place.

Click “Review” to advance the configuration. Confirm the details are correct.

Click “Submit” to finish creating the index.

If successful, Splunk will provide a token. Save this to enter into PKI Spotlight.

Configure PKI Spotlight to send events to Splunk

In the PKI Spotlight controller, go to Settings > Integrations > Splunk

You must provide the following information to complete the configuration:

Name: a friendly name to describe the connection (e.g. "Splunk HF")

URL: the full URL and port of the HTTP Event Collector e.g. https://splunk-hf.acme.com:8088. NOTE: a valid certificate is required so FQDN's are recommended

Token: this is the token generated by Splunk when you create the HTTP Event Collector input.

PKI Spotlight Add-on for Splunk

0