How to integrate Splunk with Openpath

Integrating Splunk with Openpath lets you forward event data (entry, input, reader, relay, and lockdown events) from Openpath to Splunk.

First, set up a token in Splunk

Next, create a rule in Openpath

  "requests": [
    {
      "type": "http",
      "httpParams": {
        "headers": [
          "User-Agent: Openpath/Rules Engine",
          "Content-Type: application/json",
          "Authorization: Splunk YOUR SPLUNK TOKEN"
        ],
        "method": "post",
        "url": "http://YOUR URL/services/collector/event",
        "body": "{\"event\": {{json event}} }"
      }
    }
  ]
}

View the data in Splunk

Search for the Openpath data in the index you selected previously.