Splunk サービスアカウントユーザーの設定

Splunk AppDynamics の Log Observer Connect の場合、展開に応じて、Splunk Cloud Platform または Splunk Enterprise でサービスアカウントユーザーを設定する必要があります。このサービスアカウントユーザーは、階層からログが送信されている可能性がある Splunk プラットフォームのインデックスにアクセスできる必要があります。

警告: Splunk サービスアカウントユーザーを設定するには、Splunk 管理者ロールに割り当てられている必要があります。

Setup Service Account User in Splunk Platform

Configure a role and a user in Splunk Cloud Platform or Splunk Enterprise as follows. You can create a new role and user or use an existing role and a user.

  1. First, create or select a role. In your Splunk deployment, go to Settings > Roles.
  2. Create or select the role you want for the Splunk AppDynamics service account.
    1. To create a new role, click New Role.
      注: Ensure that the role has the permission to:

      • search using wildcards as the index name (index=*).

      • search using time range provided in SPL rather than in request parameters.

    2. To select an existing role, click Edit > Edit next to the role you want to use.
  3. On the Capabilities tab, ensure that edit_tokens_own and search are selected.
    警告: Ensure that indexes_list_all is not selected.
  4. On the Indexes tab in the Included column, deselect *(All internal indexes) and select the indexes where AppDynamics application logs are stored.
  5. On the Resources tab:
    1. For Role search job limit, enter 0 for both the Standard search limit and Real-time search limit.
    2. For User search job limit, enter 0 for both the Standard search limit and Real-time search limit.
    3. For Rolesearch time window limit, select Custom time for the "maximum time window for searches for this role" and enter 2592000 (2592000 seconds equates to 30 days).
    4. For Rolesearch time window limit, select Custom time for the "earliest searchable event time for this role" and enter 7776000 (7776000 seconds equates to 90 days).
  6. Click Save if you are configuring an existing user or Create for a new user.
  7. Now, assign the role to a new or existing user. In Splunk deployment, go to Settings > Users.
  8. Create the user for the AppDynamics service account by clicking New User or Edit > Edit next to the existing user for whom you want to have the new role.
  9. For new users, enter a name and set a password. Safely retain and send the username and password to your AppDynamics Administrator, who will need these credentials to integrate Splunk AppDynamics with the Splunk.
  10. In the Assign roles section, assign the user the role you created or updated in Step 2.
  11. Click Create or Save.