Export ExtraHop metrics to Splunk
The ExtraHop system monitors network and application performance by gathering data passively on the network. It offers deep and customizable analytics of wire data in real time.
The Splunk big-data platform offers storage and correlation of a variety of data sources. Splunk collects and indexes data generated by applications, servers, and other devices.
Integrating ExtraHop with Splunk enables long-term storage of wire data and correlation of wire data with other sources, such as machine data from logs.
The ExtraHop Add-On exports ExtraHop wire data metrics as Splunk events through the ExtraHop REST API, and the ExtraHop App adds important information to the exported data, such as device IP addresses.
Note: | For a deeper integration with Splunk, you can configure the ExtraHop system to send transaction-level records to a Splunk server for long-term storage. Learn more about enabling Splunk as your recordstore. |
Install and configure the ExtraHop Add-On for Splunk
The ExtraHop Add-On for Splunk enables you to export ExtraHop wire data metrics as Splunk events. You can export metrics about any activity group, device group, or application from an ExtraHop system. After the Splunk platform indexes the events, you can analyze the data through the dashboards in the ExtraHop App for Splunk or by creating your own visualizations.
Before you begin
The ExtraHop Add-On for Splunk requires the following software:- ExtraHop firmware version 7.1.2 or later
- Splunk Enterprise version 7.3 or earlier
Note: | Because this add-on runs on Splunk Enterprise, all Splunk Enterprise system requirements apply. |
Create the metric inputs
You must create data inputs that collect information from an ExtraHop system to retrieve wire data metrics.
- On the Splunk Web home screen, click the ExtraHop Add-On for Splunk icon in the navigation bar to launch the add-on.
- Click Inputs.
- Click Create New Input.
- In the Add ExtraHop Add-On for Splunk window, specify settings for the input
- Click Add.
Create a data input for detections
The ExtraHop Add-On for Splunk contains a sourcetype for ExtraHop detections. In order to receive detections in Splunk, you must configure a data input for ExtraHop detections and configure the ExtraHop Detection SIEM Connector on your ExtraHop system.
Configure a data input in Splunk
Configure the ExtraHop Detection SIEM Connector
Install and configure the ExtraHop App for Splunk
The ExtraHop App for Splunk adds information to the data that the ExtraHop Add-On for Splunk collects, including the IP addresses, MAC addresses, and hostnames of devices discovered by the ExtraHop system. The app also creates default inputs to collect metrics about HTTP, DNS, and storage activity and then builds dashboards to display that information.
Before you begin
The ExtraHop Add-On for Splunk requires the following specifications:- ExtraHop firmware version 7.1.2 or later
- Splunk Enterprise version 7.0 or later
- ExtraHop Add-On for Splunk 1.1.1 or later
Note: | Because this app runs on Splunk Enterprise, all Splunk Enterprise system requirements apply. |
Troubleshoot the ExtraHop Add-On for Splunk
It might take some time for the data to be indexed initially by Splunk. To troubleshoot any errors that might occur with the add-on, view the splunk.log and ta_extrahop_addon_extrahop.log log files.
The search is scheduled to run every six hours. You can also run the search manually at any time by following these steps:
- On the Splunk Web home screen, click .
- From the App drop-down menu, select ExtraHop App for Splunk.
-
Click Run next to the saved search named
Retrieve Device Information.
Thank you for your feedback. Can we contact you to ask follow up questions?