Splunk App Setup and Administration

Introduction

The Query App for Splunk works in all Splunk environment types - Splunk Enterprise, Splunk Cloud Classic, and Splunk Cloud Victoria. Setting up the app is quick and easy.

After a review of prerequisites, this page describes the easy steps for how to set up the Query Federated Search Splunk app:

1. Decide whether Splunk users will have direct accounts in Query and would use their individual access tokens, or a single Query system account would be used shared by all Splunk users. We recommend the former in production deployments as it provides fine-grained access controls. The latter is suitable for POCs.
2. Based upon above, individual users or just the Query Administrator will generate the API key(s) in Query.
3. A Splunk Administrator will install the Query Federated Search App in Splunk.

Note: Our documentation assumes that you have the newest version of the Query App for Splunk (formerly known as Query Federated Search App). While we try to maintain backward compatibility with older versions of the app, we strongly advise updating to the newest version as soon as possible. Please reach out to Query Support if you need assistance with upgrading.

Access Requirements for Initial Setup

1. Query Access to generate API Key: To generate your API access key, you must have a Query account. We recommend that every Splunk user have an account in Query. Query supports Single Sign-On with key Identity Providers to make the process smoother. Please contact your Query representative for custom setup and user hydration steps based upon your Identity Provider. Alternatively, for setup ease during POCs, you can setup a single service account whose API key can be configured in the Query Splunk App to be used for all users (however that is not suitable for fine-grained role-based access control).
2. Splunk Access to setup App: The Query App for Splunk relies on Splunk's secret storage mechanism for securely storing the Query API key to authenticate to the Query platform. Therefore, to install and configure the app in Splunk you must either have the Splunk admin role or another role that specifically gives you these two capabilities:list_storage_passwords andedit_storage_passwords.

Users generate their Query API Keys

To support Splunk's communication as a client to the Query platform, users should create their personal access tokens, i.e. API keys, from the Query Console:

1. If you are not already a registered Query user, register first from the Query login page (https://go.query.ai).

2. Log in to Query. Generate a new API key as described below:

   1. Click on the Settings icon at the bottom of the left navigation bar and go to Settings.
   2. Click on the Organization section and click further to select the desired team.
   3. Click on Integrations and then click the 'Create' button to generate your API Key. Save it in a secure place for use in the following steps.

Install and Configure the Query App for Splunk

1. Are you upgrading Query App from a previous version? Make sure to check the "Upgrade app" checkbox during the installation step below.

2. Download and Install the Query app in Splunk:

   1. From Splunkbase - Go to the console of your Splunk search head and click on "Apps" -> "Find More Apps" to load the Splunkbase app store. Search for "Query Federated Search" to locate the Query App. Then just click on the "Install" button.
   2. Alternatively, Download the app from Query and Install: While logged into the Query platform Console, click on "Query Apps" in the left navigation bar and download the app from there. Next, log in to your Splunk console and go to "Apps" -> "Manage Apps" (or click on the Setup wheel). Then click the "Install App from File" button (visible to Splunk administrators only).

3. If this was an upgrade from a previous Query App version, go to this URL https://<my-splunk-host>:<port>/<locale_string>/_bump (locale_string would be en-US or equivalent, as you see in your Splunk URL). You will see a Bump button that you should click on. This is done to invalidate older versions' cached content. Go back to the Splunk console's home page and then do a refresh so that you don't have an old cache on your browser.

4. Configure Query: In Splunk’s "Apps" -> "Manage Apps" section, scroll down to the Query app and click "Setup."

5. Enter and submit the items being prompted on the setup page:

   1. API Key (Optional): If users will be using a shared system account to authenticate to Query, enter that account's API key here. Otherwise leave it empty, as individual users will enter their own key at a later step (see below) when they start using the App.
   2. HTTPs Proxy: If your environment is using a proxy for https connections, enter your https proxy URL. (NOTE: If a proxy is not specified here, the app will pick https_proxy from splunk-launch.conf.)
   3. Tenant Region: Enter the region your Query tenant is deployed in. The default is US. Enter EU if you are in EU.

6. If you didn't specify a system account API key in step 4(a) above, individual users will need to enter their own keys. Ask them to generate their keys (see steps in the section above this) and have them enter the key on the following page in their Splunk Console: Apps -> Query -> Register Access Token.

Running in Clustered Search Head Environments?

Splunk Cloud (Victoria / Classic) Cluster

Go to each node in the search head cluster and repeat the “Install and Configure” steps above.

Splunk Enterprise Cluster

You can go to each node in the search head cluster and repeat the “Install and Configure” steps above.

Alternatively, you can use Splunk Enterprise's deployer to propagate the configuration to all of your search heads. To do that, first place all configuration files in the
$SPLUNK_HOME/etc/shcluster/apps directory, and then use the splunk apply shcluster-bundle command to distribute your apps to all search heads.

Help & Support

Please reach out to Query Support at [email protected] or use the Chat function from the Query product interface if you need any assistance. Please provide this log file from your Splunk server: $SPLUNK_HOME/var/log/splunk/queryai_splunk_app.log