Update: For the most recent dashboards that use LiveWire's built in telemetry, please refer to:
- Dashboards: https://classic.splunkbase.splunk.com/app/7217/
- Ingestion: https://classic.splunkbase.splunk.com/app/7216/
Important note: This app only contains dashboards and reports. No data is collected by this app. For Capture Engine data collection, install and configure the separate TA-LiveAction-nix or TA-LiveAction-win technology add-on.
The LiveAction for Splunk App is a long term monitoring and reporting solution for LiveAction LiveWire. With the LiveAction for Splunk App, many different kinds of network and application statistics and hundreds of different types of events events from one or more Capture Engines can be viewed in dashboards as an aggregated set or individually. Within the dashboards, any range of time can be chosen, and statistics and events from different times can be compared.
Although we believe the dashboards provided are useful, we look at them as a starting point, and users are encouraged to customize, enhance, and clone the dashboards to create their own. The wealth of statistics and events from Capture Engines can also be correlated with other data in completely different dashboards. This is when the insight happens about how the network affects other aspects of the business, and vice versa.
The LiveAction Splunk App requires a physical LiveWire appliance or LiveWire Virtual software.
The LiveAction Splunk App builds on the ability of LiveWire to output events and statistics as CSV files at specified intervals, and have them ingested into a Splunk Server. The LiveAction for Splunk solution consists of a Capture Engine and a Splunk Server.
On the machine running the LiveWire there is a Splunk Forwarder and a LiveAction Technology Add-on (TA). The Splunk Forwarder is a utility available for Windows and Linux that is offered for free by Splunk. The Splunk Forwarder forwards data from the LiveWire to the Splunk Server. The LiveWire and the Splunk Forwarder are always installed onto the same machine. The TA is the package that tells the Splunk Forwarder where to find the CSV files, and what to do with them. There are 2 TA’s, one for Windows and one Linux. Both TA’s are on Splunkbase, and the SplunkForwarder is on the Splunk website.
The LiveAction Splunk App is installed into a Splunk Server. The Splunk Server is also offered is a cloud service called Splunk Cloud, so the LiveAction Splunk Dashboards can be installed in the cloud as well.
The Splunk Forwarder and the Splunk Server index the CSV reports generated by a Capture Engine. In order to generate CSV reports that the SplunkForwarder will find, the capture must be named “Splunk”, and both Analysis Options and Statistics Output have to be enabled. Setting up the Splunk Forwarder to index the CSV files is described below for both Windows and Linux. The only difference between Windows and Linux is which TA package to use.
Linux TA - https://splunkbase.splunk.com/app/2746/
Windows TA - https://splunkbase.splunk.com/app/2747/
The Splunk Server indexes the data coming from the LiveWires, and stores the data. The data from each of the CSV files is stored into a different custom index. For example, the protocol statistics are stored in the index called “sv_protocols”, and the nodes statistics are stored in the index called “sv_nodes”, and the flows are in “sv_flows”, and so on. This makes it possible to display the data for a particular index by typing “index=nodes” or “index=protocols” into the Splunk search field.
Warning: The creation and growth of these indexes will use disk space.
The LiveAction Splunk App provides dashboards in the Splunk UI that display network statistics from one or more LiveWires. There are high level dashboards like the Network Dashboard, Security Dashboard, and VOIP Dashboard, which display trends about the network and the events taking place on it. There are also lower level dashboards that display lists of network activity like nodes, flows, and protocols. All of the dashboards are completely web-based and can be customized and extended in many ways.
The Splunk license pricing model is usage based. The free license allows up to 500MBs per day of data to be indexed. More data can be indexed by purchasing a license. Splunk offers perpetual licenses and a term license. More on Splunk licenses can be found here: https://www.splunk.com/en_us/products/pricing.html.
none
none
Version 1.0 of the LiveAction Splunk Dashboards is compatible with:
none
The LiveAction Splunk Dashboards are supported by LiveACtion for customers who have purchased maintenance with their LiveWire products.
LiveAction supports the following server platforms in the versions supported by Splunk Enterprise:
none
Because this add-on runs on Splunk Enterprise, all of the Splunk Enterprise system requirements apply.
Download the LiveAction Splunk Dashboards at https://splunkbase.splunk.com/app/2730
This document provides instructions on how to set up the Savvius for Splunk integration.
To receive data from a LiveWire (Linux) or an OmniPeek Capture Engine (Windows) download either the TA-LiveAction-nix or TA-LiveAction-win and follow the installations in the documentation tab for those downloads.
Once the LiveAction Splunk App has been installed into the Splunk Server, it will appear on the Splunk Home page as “LiveAction”. Select this entry, and then select the Dashboards entry on the next page.
Version 1.0.2 - First release on Splunkbase
Version 1.0.1
- First release of LiveWire Dashboards for Splunk
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.