financial-times/splunk-fastly

Splunk app for Fastly real-time log streaming to the Splunk HTTP Event Collector.

Fastly Splunk app

Support for Fastly's real-time log streaming packaged as a Splunk app.

This Splunk app is compatible with the Splunk Common Information Model (CIM) for Web.

Source types

Source type	Description
fastly:request	Fastly service request logs. See the "Fastly Logging Format" proposal for documentation on the message format.

Lookups

This app depends on a CSV lookup called GeoLite2-ASN-Blocks-IPv4.csv. The file can be downloaded from the MaxMind website, in the GeoLite2 ASN database.

Releasing

Create a release in GitHub to trigger a workflow that builds and uploads an package to the GitHub release assets, e.g. splunk_fastly-1.0.0.tar.gz. This file can be installed on Splunk.

The version number in app/default/app.conf will automatically be updated in the default branch to match the release via a pull request.

splunk-fastly's Issues

Import audit log into Splunk using the `/events` Fastly API endpoint

See https://docs.fastly.com/en/guides/monitoring-account-activity-with-the-audit-log#accessing-the-audit-log-via-the-api.

https://developer.fastly.com/reference/api/account/events/

The Splunk Add-on Builder might be helpful, it has support for configuring inputs based on data from HTTP requests.