-
Notifications
You must be signed in to change notification settings - Fork 60.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add audit log troubleshooting note #30637
Conversation
Thanks for opening this pull request! A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines. |
Automatically generated comment ℹ️This comment is automatically generated and will be overwritten every time changes are committed to this branch. The table contains an overview of files in the Content directory changesYou may find it useful to copy this table into the pull request summary. There you can edit it to share links to important articles or changes and to give a high-level overview of how the changes in your pull request support the overall goals of the pull request.
fpt: Free, Pro, Team |
@danelson Thanks so much for opening a PR! I'll get this triaged for review ✨ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks @danelson! Since this is conceptual information, can you please move it before the procedure, just after this paragraph:
To stream audit logs to Splunk's HTTP Event Collector (HEC) endpoint you must make sure that the endpoint is configured to accept HTTPS connections. For more information, see Set up and use HTTP Event Collector in Splunk Web in the Splunk documentation.
After you do that, I can review the content of the note itself. Thanks!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for making this change! I'm going to apply a small suggestion and then merge. ⚡
...rise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise.md
Outdated
Show resolved
Hide resolved
Thanks very much for contributing! Your pull request has been merged 🎉 You should see your changes appear on the site in approximately 24 hours. If you're looking for your next contribution, check out our help wanted issues ⚡ |
Why:
This came out of a support ticket. We host a Splunk HEC endpoint via Splunk HEC receiver in OpenTelemetry. When exposing this endpoint publicly we were not accepting traffic on /services/collector and the audit log configuration validation was failing.
Hopefully a note such as this can help others in the future.
What's being changed (if available, include any code snippets, screenshots, or gifs):
Add a note so that users who configure Splunk HEC audit log export know that /services/collector must be reachable
Check off the following:
I have reviewed my changes in staging, available via the View deployment link in this PR's timeline.
data
directory.For content changes, I have completed the self-review checklist.