On-Prem Analytics Offload Demo with Splunk
Key Points
- The new 5070 on‑prem analytics offload feature adds a Settings → Analytics tab that supports four event types (API, monitoring, log, and audit) and lets users choose a default output or a secondary export to a third‑party system.
- Four export destinations are available—Elasticsearch, Kafka, CIS log, and HTTP—allowing flexible integration with external analytics platforms.
- In the demo, monitoring events are routed via the CIS log output to Splunk by simply configuring host, port, protocol, and optional SSL settings, then verifying with a test event.
- API events are sent to Splunk through an HTTP output that requires specifying the URL, TLS profile, and custom headers (authorization and request channel) before confirming successful delivery by invoking the API and viewing the events in Splunk.
Full Transcript
# On-Prem Analytics Offload Demo with Splunk **Source:** [https://www.youtube.com/watch?v=5SoklXsrNO0](https://www.youtube.com/watch?v=5SoklXsrNO0) **Duration:** 00:03:17 ## Summary - The new 5070 on‑prem analytics offload feature adds a Settings → Analytics tab that supports four event types (API, monitoring, log, and audit) and lets users choose a default output or a secondary export to a third‑party system. - Four export destinations are available—Elasticsearch, Kafka, CIS log, and HTTP—allowing flexible integration with external analytics platforms. - In the demo, monitoring events are routed via the CIS log output to Splunk by simply configuring host, port, protocol, and optional SSL settings, then verifying with a test event. - API events are sent to Splunk through an HTTP output that requires specifying the URL, TLS profile, and custom headers (authorization and request channel) before confirming successful delivery by invoking the API and viewing the events in Splunk. ## Sections - [00:00:00](https://www.youtube.com/watch?v=5SoklXsrNO0&t=0s) **On‑Prem Analytics Offload Demo** - Mark Nesbet demonstrates the new 5070 on‑prem analytics offload feature, walking through event‑type settings, default and secondary export options (Elasticsearch, Kafka, CIS log, HTTP) and showing how to route API and monitoring events to Splunk via HTTP and CIS log. ## Full Transcript
hello my name is Mark nesbet I work for
the analytics team and today I'll be
doing a very brief demo of the new 5070
on-prem only analytics offload
feature as you see I'm currently logged
into the cloud Management console for
the on-prem system if you navigate to
settings analytics this is a new tab
we've introduced in
5070 looking closely we support four
event types API events
monitoring events which is Gateway and
management node performance related data
log events are typically sent from the
Gateway and include error conditions and
other log events audit events are
typically show up in the notifications
bar up top here and CMC UI and API UI
and include things as notifications when
an organization is created or an API is
published uh the for each API for each
event type the user can either configure
the default analytics output which is
the default out of the box or they can
optionally select a second export option
to a third party
system the four output types we include
are elastic search Kafka CIS log and
HTTP for the demo I'm just going to show
you how we can export API events to
through the HP output to Splunk and also
additionally show how we can export
monitor events through CIS log to Splunk
as well taking a look at the CIS log
configuration first you can see that the
configuration is pretty straightforward
you just hit configure come in select a
host Port protocol optionally includes
some SSL related information and hit
update the user can also send a test
event to verify that their connection
information is correct I've already
configured this and it's already running
so if I come into Splunk here and look
for the data summary and go into the
sources you can see here's my CIS log
listener
and you can see here's the actual
performance monitoring events received
by
Splunk coming
back for the API events um I've already
configured an HTTP output for API events
the configuration is a little bit more
complex uh we must specify an H URL I've
shown an example with SSL configured
using the default TLS
profile I've also had to add a couple
HTTP headers to connect to Splunk uh one
is an authorization header to authorize
with the Splunk server and the second
one is the request Channel which helps
Splunk determine where to send the
actual analytics
data this is also configured so if I
come in here and invoke my API a few
times we should now be able to go back
into Splunk go back into the
search here's the configured HTTP output
token click here and you should be able
to see the actual two or three events
I've just
published and that incl concludes my
demo for today thank
you