hashi-demo-lab / splunk-demo Goto Github PK

This repository will deploy a Splunk Enterprise instance into AWS and pre-configure some indexes and dashboards to collect logging and telemetry from HashiCorp Vault, HCP Vault and Terraform Cloud for Business.

1. Clone the repo to your own github account
2. Connect the repo to a new TFC worksapce using the VCS workflow
3. Ensure that the essential variables are configured:
   1. AWS Credentials
   2. Prefix, Email, ttl and name
   3. splunk_domain
4. Create an initial plan via the TFC UI
5. If all the above is done correctly, you'll have a working splunk environment at the output of the splunk_url

1. There are three main integration points for Splunk Dashboards:
   1. HCP Only
   2. On-Premises Vault
   3. Terraform Cloud
2. For a HashiCorp SE - the easist method is to collect the zipped files and deploy them directly to splunk. You'll need to collect these from a colleague and they should not be shared.

1. Login to the splunk dashboard
2. In the left-hand-side navigation, click the cog next to Apps
3. Click Install App From File and upload the zipped file
4. Restart Splunk as part of the process
5. Navigate to Terraform Cloud for Splunk App
6. Continue to app setup page
7. Create a TFC Organization Token and apply it into the setup
8. Start using the dashboards, etc

1. Login to the splunk dashboard
2. In the left-hand-side navigation, click the cog next to Apps
3. Click Install App From File and upload the zipped file
4. Restart Splunk as part of the process
5. Within the Splunk UI ensure that the collector token is enabled:
   1. Settings -> Data Inputs -> HTTP Event Collector -> Global Settings -> All Tokens = Enabled
   2. Collect the Token Value for the HCP_Vault_Events
6. Open HCP Dashboard and navigate to your Vault cluster and then Metrics
7. Configure the Splunk app with your HEC and token from above
   1. HEC Might look something like https://splunk.cameron.aws.hashidemos.io:8088
   2. Note: there is no need to use the example from the HCP-V tutorial or from Splunk website!