Splunk Cisco Meraki Modular Input v1.5.4

IMPORTANT

The Python code in this App is dual 2.7/3 compatible. This version of the App enforces Python 3 for execution of the modular input script when running on Splunk 8+ in order to satisfy Splunkbase AppInspect requirements. If running this App on Splunk versions prior to 8 , then Python 2.7 will get executed.

Overview

This is a Splunk modular input add-on for Cisco Meraki that allows you to receive JSON probe events from the Meraki Presence Cloud.

Dependencies

• Splunk 5.0+
• Supported on Windows, Linux, MacOS, Solaris, FreeBSD, HP-UX, AIX

Setup

• Untar the release to your $SPLUNK_HOME/etc/apps directory
• Restart Splunk
• Browse to the Meraki App in Splunk and enter the Meraki Secret and Validator in the setup screen.
• Then Browse to Settings -> Data Inputs -> Cisco Meraki to add a new Input stanza that will establish a new Meraki HTTP server to listen for event data
• Choose a port to listen on in Splunk , anything you want > 1024 would be sensible unless you are running Splunk as a privileged user
• Choose your Meraki API version
• Setup sourcetype/index etc….
• Then on the Meraki side of things you will configure to send events to the HTTP(s) POST URL , and specify the port in the URL also : http://yoursplunkhost:yourport/events

Activation Key

You require an activation key to use this App. Visit http://www.baboonbones.com/#activation to obtain a non-expiring key

Logging

Modular Input logs will get written to $SPLUNK_HOME/var/log/splunk/merakimodinput_app_modularinput.log

Setup logs will get written to $SPLUNK_HOME/var/log/splunk/merakimodinput_app_setuphandler.log

These logs are rotated daily with a backup limit of 5.

The Modular Input logging level can be specified in the input stanza you setup. The default level is INFO.

You can search for these log sources in the _internal index or browse to the Logs menu item on the App's navigation bar.

Troubleshooting

• You are using Splunk 5+

Support

BaboonBones.com offer commercial support for implementing and any questions pertaining to this App.