Getting Started
Last updated
Was this helpful?
Last updated
Was this helpful?
Here is how to get started with Scanner for Splunk, allowing you to index your logs in S3 at low cost and search them at high speed directly from within Splunk.
Using tools like Vector.dev, Cribl, or other log pipeline tools, you can store your logs in S3 instead of sending them directly to Splunk.
Many tools, like Crowdstrike Falcon Data Replicator and the Github Audit system can write logs directly to your S3 buckets.
Once you have logs in your S3 buckets, you can start to index them with Scanner. We support JSON, CSV, Parquet, and plaintext log files. No need to transform them first. Just point Scanner at your raw log files.
Following the guide, configure Scanner to index these logs in S3. This allows search queries to execute at high speed even as data volumes reach hundreds of terabytes or petabytes.
In your Splunk instance, navigate to Apps > Manage apps.
Click Browse more apps.
Search for Scanner for Splunk.
Click on the Install button.
Visit the , and download the app. It will be downloaded to your desktop as a .tgz
file.
In you Splunk instance, navigate to Apps > Manage apps.
Click Install app from file.
Choose the .tgz
file you downloaded earlier.
After you install the Scanner for Splunk app, you will be prompted to set up the app for the first time. If you proceed, you will be directed to the configuration page.
If you need to view the configuration page again later, simply click on Scanner for Splunk in the app sidebar. Also, you can navigate to Apps > Manage apps, find the Scanner for Splunk row, and click the Set up link there.
Within the Scanner for Splunk configuration page in Splunk, add the API URL of your Scanner instance, and add API keys. You can find your API URL and API keys by visiting Scanner and navigating to Settings > API.
Each API key is assigned to a Splunk role. Within Scanner, you can configure the RBAC permissions of API keys, giving them varying permissions to indexes and detection rules in Scanner.
When a user runs a Scanner command, it will run with the combined permissions of all of the API keys of the user's roles.
API keys are stored in Splunk's storage passwords feature, as required by Splunk Cloud. As a result, each Splunk role must have the list_storage_passwords
capability. Otherwise, the role will not be able to view the API keys stored in Splunk's storage passwords feature.
scanner
and scannertable
search commands from within SplunkStart executing search queries against your high-volume logs in S3 by using the scanner
and scannertable
custom search commands. These commands are available system-wide.
The commands take a parameter q
, which must be a query written in Scanner's query language.
The query is executed against Scanner's . By default, the API returns the most recent 1000 results in descending timestamp order.
Follow along for more information about running in Splunk.