Cloudflare logs to Splunk | How to link

Cloudflare logs to Splunk is an easy task with a little assistance from our experts. Read on to find out more. 

At Bobcares, we offer solutions for every query, big and small, as a part of our Server Management Services.

Let’s look at how our Support Team helped our customers learn more about enabling Cloudflare logs to Splunk.

How to link Cloudflare logs to Splunk

Cloudflare offers us in-detail logs of all our HTTP requests. We can use these logs to identify configuration adjustments, debug, improve security, create custom analytics, and so on. Furthermore, we can combine these request logs with other data sources like application server logs as well.

Cloudflare’s Enterprise plan includes a feature called Logpush. It is responsible for delivering a batch of logs as a gzipped file. This file contains the data in the newline-delimited JSON format or as a JSON lines Open external link to our destination.

On the other hand, Splunk is a data platform that offers enterprise observability, limitless custom applications and unifies security as well. It is very helpful in searching through and monitoring big data. Additionally, it generates reports, alerts, and visualization to make our job easier.

Today, our Support team is going to demonstrate how to link Cloudflare logs to Splunk by enabling Logpush to Splunk. In fact, we can get this done via the Cloudflare dashboard or via API.

Enable Cloudflare Logpush to Splunk: Cloudflare Dashboard

1. To begin with, log in to the Cloudflare dashboard and select the Enterprise domain we want to use with Logpush.
2. Then, head to Logs under Analytics.
3. Next, select Connect a service. This causes a modal window to open where there are a few additional steps to complete.
4. After that, choose the dataset we want to push to the storage service.
5. Then, choose the data field to include in our logs. We can remove or add fields at a later point in time by changing the settings in Logpush under Logs.
6. Next, select Splunk.
7. Then, enter the following information:
   • Splunk raw HTTP Event Collector URL
   • Channel ID
   • Auth Token
   • Source Type
   • Use insecure skip verify option
8. Then click Validate access.
9. Finally, select Save and Start Pushing in order to finish the process.

After following the above steps to link Cloudflare logs to Splunk, we will be able to see Splunk listed as a connected service in Logpush under Logs.

Enable Cloudflare Logpush to Splunk: API

1. First, create a job with the corresponding endpoint URL as well as authentication parameters.
2. Then, enable the job in order to start linking Cloudflare logs to Splunk.

[Need assistance with a different issue? We are available 24/7.]

Conclusion

In a nutshell, our skilled Support Engineers at Bobcares demonstrated how to start linking Cloudflare logs to Splunk.