Now you index your DataPower performance and configuration data in Splunk!
This TA provides the ability to make REST API calls to the DataPower Mangement REST API - retrieving configuration, status/performance data and filestore information for the appliance.
All endpoints within the status, configuration and filestore Management REST API are now supported.
Contact us for assistance with additional requirements, production deployments, large scale deployments.
Note that this is a breaking change - existing users should check differences and update any developed searches as appropriate.
To setup DataPower monitoring from Splunk using this TA you will need to have the following:
A docker image (used to develop this TA) is available [here] (https://developer.ibm.com/datapower/docker/) - details on how to setup the docker image and a simple service are also documented at this location.
IBM provide a developers edition download [here] (https://www-01.ibm.com/support/docview.wss?uid=swg24040591)
Enabling the REST management interface is documented [here] (https://www.ibm.com/support/knowledgecenter/en/SS9H2Y_7.2.0/com.ibm.dp.doc/webgui_restinterface.html)
Once installed, launch the app.
Click on "Configuration":
(1) Add an account with the credentials you will use to make the REST API Calls
(2) Click Add-on Settings and add the hostname and port of the datapower device to be monitored
To setup a REST API call to an available DataPower endpoint:
(1) Click Inputs
(2) Click Create New Input
(3) Select the type of call to be made: Status, Config or Filestore
(4) Enter a name for the input - it's best if the name matches the metric or class name, e.g. SystemUsage
(5) Enter the polling interval in seconds (e.g. 60)
(6) Choose the index to store the events in
(7) Enter the text of the DataPower domain to be monitored
(8) Enter the metric name / configuration class / filestore path to be monitored
(9) Click Add
=> Congratulations, you are now monitoring your DataPower appliance.
Switch to the Search tab
set the timerange to "Last 15 minutes"
enter search: index=main" (or the name of the index you selected in step 6 above)
check for the events
You can also add and edit via Settings - Data - Data Inputs.
10th March 2017: Edinburgh: Initial Release of IBM DataPower TA
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.