Skip to main content

CollectorsCloud Collectors Administration Guide

Prerequisites to Configure the Splunk Cloud Collector

Before you configure the Splunk Cloud Collector you must complete the following prerequisites:

Allow Exabeam IP Addresses for your Region

Allow the IP addresses for your region to enable the Splunk Cloud Collector to connect and use the Search APIs on the Splunk Cloud platform. To do this, navigate to SYSTEM > Server Settings > IP allow list > Search head API access on the Splunk Cloud console and provide the relevant IP addresses for your region.

Based on your network requirements, to allow the IP addresses for your region to enable the Cloud Collector to connect with your cloud platform, see Allow Exabeam IP Addresses for your Region.

Splunk_Portal_whitelisting.png

For more information see Determine IP allow list use case in the Splunk Cloud documentation.

Create a User Role and a User in the Splunk Cloud Console

The Splunk Cloud Collector supports two authentication methods: Basic and Token. If you choose to use the Token authentication method while creating a sharable account for Splunk cloud, ensure that you have a role User assigned to you. The token inherits the privileges or capabilities of the user who creates the token.

If you choose to use the Basic authentication method, you must create a new role and a user in the Splunk Cloud Console.

Create a New Role

To create a role:

  1. Log in to the Splunk Cloud Console with your registered user name and password.

  2. Navigate to Settings > Users and Authentication > Roles.

    create_role__1.png

  3. Click New Role.

    new_role.png

  4. In the Inheritance section, select the role user to let the new role inherit all the capabilities of the assigned role.

    new_role_user.png

  5. The Capabilities section displays the inherited capabilities of the selected role user.

  6. The Indexes section displays the inherited (All non-internal indexes) of the selected role user .

  7. Retain the default values for Restrictions.

  8. In the Resources section, set the limit for user search job. The Splunk Cloud Collector uses the standard search method to collect data based on the Splunk query. Set the Standard search limit to 20 in the User search job limit area. If any Splunk Cloud Collector instances display throttling errors, increase this limit.

    Use_search_Job_limit.png

  9. Click Create.

    Use this role specifically for configuring the Exabeam Splunk Cloud Collector.

Create a New User

After you create a role in the Splunk cloud console, you can assign this role to the newly created user. To create a user:

  1. Log in to the Splunk Cloud Console.

  2. Navigate to Settings > Users and Authentication > Users.

    create_user_1.png

  3. Click New User.

  4. Enter the name and password for the new user. While creating a sharable account for the Splunk Cloud Collector, use this user name and password for the fields Login and Password for the Basic authentication method.

    Create_new_user_2_1.png

  5. In the Assign roles section, assign the role that you created for the Exabeam Splunk Cloud Collector.

  6. Clear the check boxes for the fields Create a role for this user and Require password change on first login.

  7. Click Save.

    A new user is created. When you create a user in the Splunk Cloud console, Splunk sets limits for a user to limit a user from overburdening the system with searches. To edit the role search job limit, user search job limit, role search time window limit, and disk space limit, navigate to Settings > Roles. For more information see Specify default app and search-related limits for a role in the Add and Edit Role section in the Splunk Cloud documentation.