First-time setup instructions for the Edge Processor solution

The data management control plane in your Splunk Enterprise deployment is your entry point to managing Edge Processors, where you can perform actions such as configuring and deploying Edge Processors, creating data processing pipelines, and more.

If you are the first user, you need to complete a one-time setup procedure before you can access the pipeline building experience and begin managing Edge Processors. During this setup procedure, you enable the Edge Processor service on your data management control plane and configure the host and port that Edge Processors should use to communicate with the Edge Processor service.

In order to monitor the Edge Processor solution, Splunk must be able to listen and receive Edge Processor logs and metrics for designated indexes in the Splunk Enterprise deployment. By default, the Splunk Enterprise machine that hosts the data management control plane will be used as the storage location for these logs and metrics generated by Edge Processors and is listed as the default_telemetry_indexer destination on the Destinations page. However, this destination should be configured to send Edge Processor usage logs and metrics to the indexer tier of your Splunk Enterprise deployment. See Edge Processor service for more information on the default_telemetry_indexer destination.

Note: This one-time setup process is only required for admins setting up Edge Processor on the data management control plane for the first time. Once this process is completed, you don't need to go through it again.

Prerequisites

Ensure that the following steps are completed before beginning the first-time setup process.

  1. Set up a data management control plane in your Splunk Enterprise deployment. This control plane will host the Edge Processor service. See Set up a data management control plane for information about the control plane, prerequisites, and the setup process.
  2. Confirm that you can access the Data Management app

Confirm that you can access the Data Management app

Before beginning the first-time setup procedure for the Edge Processor solution, confirm that your Splunk Enterprise account has the required capabilities .

  1. Log in to the Splunk Enterprise instance hosting your data management control plane as an administrator.
  2. In the Settings menu, in the Users and authentication section, select Users.
  3. In the row that lists your username, select Edit and then select View Capabilities.
  4. Check if your account has the admin_all_objects capability. If your account doesn't have that capability, assign it. See Define roles on the Splunk platform with capabilities in the Securing Splunk Enterprise manual for more information.
  5. In the Apps menu, select Data Management. If you have enabled Edge Processor on your Splunk Enterprise deployment, then you will be redirected to your tenant. If you have not enabled Edge Processor, you will be prompted to go through the enablement process. See Enable Edge Processor in Splunk Enterprise for the steps to enable the Edge Processor service.

If you encounter authentication errors or cannot access the Data Management app despite ensuring that your user account has the required capabilities, contact your Splunk representative for assistance.

Enable Edge Processor in Splunk Enterprise

Start by enabling the Edge Processor solution on your data management control plane.

  1. Open a browser and log into https://<localhost>:8000 using a Splunk Enterprise user account that has the admin_all_objects_capability. The <localhost> address should be the Splunk Enterprise instance that hosts your data management control plane.
  2. Select the Data Management app from the Apps menu. You will be prompted to configure the Splunk Pipeline Builders app.
  3. On the First-time setup page, select the checkbox to enable Edge Processor.
  4. In the Splunk REST API Origin field, enter your data management control plane hostname and management port using the schema https://<hostname>:8089.
  5. Select Save to save these settings to your .conf files.
  6. Once prompted, select Restart Splunk to restart your instance. You will be redirected to sign in.
  7. On the login screen, log into your data management control plane using the same admin account.
  8. Navigate to the Data Management app. If your restart and setup was successful, you will see a screen that says No Edge Processors to display.

Next steps

Now that you've finished setting up the Edge Processor solution on your data management control plane, you can start using it to receive, transform, and route your data. For more information on how to get started, see Quick start: Process and route data using Edge Processors.