Migrate CrowdStrike inputs from the Splunk Add-on for CrowdStrike FDR

Assess and migrate enabled CrowdStrike FDR inputs from the Splunk Add-on for CrowdStrike FDR to Data Inputs.

  • Migration and rollback are available in Data Inputs version 1.18.1.

  • Sign in with an admin or sc_admin role. The assessment verifies that the migration assistant can read the AWS credentials and, when applicable, CrowdStrike API credentials stored by the Splunk Add-on for CrowdStrike FDR.

  • Before you start, confirm that each CrowdStrike FDR input you plan to migrate is enabled and has a valid configuration in the Splunk Add-on for CrowdStrike FDR. Keep the migration record and source configuration until you verify the migration.

Use the migration assistant in Data Inputs to assess CrowdStrike inputs, choose a batch to migrate, and monitor migration progress.
Note:

Don't edit the source or destination CrowdStrike configurations during assessment, migration, or rollback.

  1. Log in to Splunk Cloud and select the Data Inputs app.
  2. On the Data Inputs page, select + Data Input.
  3. Make sure Ingest is selected, then select CrowdStrike and then select Next.
    For CrowdStrike data, you can ingest data only from single accounts.
  4. On the CrowdStrike Data Onboarding page, select the option to migrate an existing CrowdStrike input and then select Next.
  5. Review the prerequisites page and select Next.
  6. On the CrowdStrike Migration Assistant page, select Scan CrowdStrike TA inputs.

    The assessment lists the inputs it can migrate and explains why it cannot migrate the others.

  7. Review the assessment results. For each blocked input that you want to migrate, fix the reported issue and rerun the assessment. You can migrate inputs marked Ready without resolving unrelated blocked inputs.
    Note: You can migrate up to 20 inputs in one batch.

    Assessment errors can include:

    • Amazon Web Services (AWS) credentials are missing.
    • An Amazon Simple Queue Service (SQS) queue is missing or inaccessible.
    • The assessment found a duplicate SQS queue URL.
    • The input references a filter that does not exist.
    • Device enrichment is configured, but the input has no credentials for the CrowdStrike application programming interface (API).

    During migration, Data Inputs generates a supported, unique name for each migrated input, replacing unsupported characters such as hyphens. Inputs that are turned off are skipped and are not reported as invalid.

  8. Select the inputs to migrate in one batch, then select Start migration.

    Monitor the progress indicator until the migration finishes. When it succeeds, Data Inputs creates a corresponding input and connector and turns off the migrated input in the Splunk Add-on for CrowdStrike FDR. Inputs you did not select remain unchanged.

  9. Verify the migration in Data Inputs. Confirm that the new input reports a successful status and is ingesting data.

    If deployment is reported as unconfirmed, verify deployment status and incoming events before treating the migration as complete.

    If a migration fails, Data Inputs attempts to roll it back automatically. Check the rollback result before you retry.

After a successful migration, the Data Inputs input is active and the legacy add-on input is inactive. A successful rollback restores the previous add-on configuration and does not change indexed data.

If your post-migration checks find missing events, unexpected filtering or enrichment, or deployment problems, use the migration assistant to roll back the latest migration run. See Roll back a CrowdStrike migration.