This repo provides the necessary resources to forward data from the Traceable Platform to a Splunk HTTP Event Collector. The details below will walk you through how to get started.
Prerequisites
- install aws cli
- install terraform
- configure aws aws configure
- Splunk HEC Token - https://docs.splunk.com/Documentation/Splunk/8.2.4/Data/UsetheHTTPEventCollector
Build&Deploy
Compile the program
cd aws
make build-zip
This will create a zip file in the: bin/splunk-hec-integration-aws.zip
Configure
Review the aws/variables.tf and change the following config values:
variable "s3_bucket" {
description = "Name S3 the Bucket to be created to store the code used by the Lambda" type = string
default = "<CHANGE_ME>"
}
variable "splunk_hec_token" {
description = "Splunk HEC TOKEN" type = string
default = "<CHANGE_ME>"
}
variable "splunk_hec_url" {
description = "Full Url of Splunk HEC http://localhost:8088/services/collector/event" type = string
default = "<CHANGE_ME>"
}
Deploy
cd aws
terraform plan
terraform apply
This will create the following as aws/variables.tf
- Create S3 bucket to store this code(binary program)
- Upload the bin/splunk-hec-integration-aws.zip to the s3 bucket
- Create a lambda function. it will load the program from s3
- Create a cloudwatch log group
- IAM Role, Permissions etc for lambda exec
- API Gateway, route mapping etc
Configure Traceable
Now that all the components are configured we can create a channel to push notifications in the Traceable UI. First head to the user menu in the top right and click on "Administration" from there click into "Notifications" on the left hand side.
- Create a channel, here's where you'll give Traceable an avenue to push notifications. Copy the url of the lambda function from AWS and enter it under the "custom webhook" field as such:
- to find the url of the lambda go to the AWS console - Lambda - Functions - Configuration - Triggers
- Now the last step is to create a notification. This controls what sort of events you'd like to have pushed to Splunk. Be sure to select the channel you created in the previous step for "Who should recieve this notificaton" as outlined in the screenshot below.