Skip to content

Splunk - Configuration Guide

Splunk Indexes & Token

Following indexes have been set up for KaaS platform on Splunk.

  • kaas_audit_logs
  • kaas_dev_index
  • kaas_prd_index
  • kaas_qa_index
  • kaas_tst_index

Tokens associated with the splunk indexes are stored in the PIM safe named "NNG_UM_KAAS_BUILD" in the file named "KaaS - Splunk Indexes and Tokens.txt".

Splunk tokens should be treated as sensitive data (secret data).

Query in Splunk

index="kaas_audit_index" "data.methodName"="create" OR "data.methodName"="update" OR "data.methodName"="delete*"