This app uses the Swit Audit Logs API to store logs in Splunk through the Log Pull method.

This app can be installed on On-Prem or Cloud deployments of Splunk.

Download this app from Splunkbase.
Install it manually by adding the installation file to your Heavy Forwarder (HF) or SearchHeader.

[Splunk Classic Cloud]
You cannot install an app directly on Classic. Please request Splunk to install it for you through a support ticket.

[Splunk Victoria Cloud]
Search for “Swit Add-on for Splunk” in "Apps" and install it directly.

The configuration steps are common for On-prem and Cloud.

Open the Web UI where you installed this app.
In the “Manage Apps” section in Splunk, find the Swit Add-on for Splunk and go to the settings.
Click on the “Add token” button to generate your access token for using the Swit Audit Logs API and save the generated token value.
Go to Splunk Settings > Data > Data Inputs and find “Swit Audit Logs Modular Input”, then click “New” to enter the input.
1. Name: Provide a name for the input
2. API Key: Provide the access token value you saved in Step 3
3. Interval: Provide a number in seconds for the query interval
4. Source type: Select JSON for the source type from the dropdown list
5. Index: Select the index to store the collected data
Once you provide the inputs correctly, the log collection will be started.

Swit Add-on for Splunk

0