Splunk Add-on for Google Drive
Overview
Details
It also serves as an example for using OAuth to authenticate a modular input. More information can be found in Splunk's Developer Guidance (http://dev.splunk.com/goto/devguide)
About
This add-on allows for indexing of metadata about Google Drive usage within an
organization. It captures audit events such as file creation, access, and
deletion.
It also serves as an example for using OAuth to authenticate a modular input.
More information can be found in Splunk's
Developer Guidance.
Installing
To use this add-on, you must first create an project in the
Google Developers Console
- Create a new project, giving it whatever name suits your needs.
- In your new project, click on
APIs & auth->Credentialsin the nav bar. - Click the
Add credentialsbutton and selectOAuth 2.0 client ID - Follow the prompt to create a product name for your consent screen
- Select an
Application typeofOther, give it a name and pressCreate - Take note of your client ID and secret
Now set up the input in Splunk:
- As an admin, go to the
Settingsmenu and selectData inputs - In the
Google Drive Activity Streamrow, clickAdd new - Give your input a descriptive name and remember it, as we will need it when
authorizing in the next step. - Click
More Settings- Set the interval to the rate at which you want to query Google Drive.
86400 (24 hours) is a good value. - Set the sourcetype to
google:drive:activity
- Set the interval to the rate at which you want to query Google Drive.
- Save the configuration
Finally, we need to authorize the input. At the command line:
- Ensure that the environment variable
$SPLUNK_HOMEis set to your Splunk
installation directory -
Run the following command (split into multiple lines for clarity):
$SPLUNK_HOME/bin/splunk cmd python $SPLUNK_HOME/etc/apps/splunk-add-on-google-drive/bin/configure_oauth.py <input name> <client ID> <client secret>This will give you a URL that
you can copy and past into a browser. Once you authenticate with your Google
username and password you will get a key that you can then paste into the
prompt.
3. Go back to the input you created above and disable and reenable it to kick
off the modular input process immediately.
Case Study
For a case study showcasing the application of this add-on, see the Splunk Reference App - PAS and the accompanying Splunk Developer Guidance.
Release Notes
Version 0.9.2
For the up-to-date Release Notes, issue tracking and source code, check out https://github.com/splunk/splunk-add-on-google-drive
Version 0.9.1
For the up-to-date Release Notes, issue tracking and source code, check out https://github.com/splunk/splunk-add-on-google-drive