How to Integrate Chef Automate with Splunk Software

Progress Chef and Splunk, two prominent DevOps solutions, can work together to bring more depth to real-time monitoring by automating data collection across systems.

This integration benefits organizations by allowing Splunk to analyze configuration data, compliance metrics, infrastructure changes and application logs provided by Chef.

This blog discusses how this integration works, what data is shared and how to set it up.

What is Chef Automate?

Progress Chef Automate provides an integrated platform for automating infrastructure, applications and compliance tasks across your organization's environments. It’s the hub for managing and orchestrating workflows, maintaining consistency and driving compliance within DevOps pipelines.

What is Splunk Software?

Splunk is a real-time platform designed to search, monitor, analyze and visualize machine-generated data. It’s widely used for operational intelligence, application monitoring, security and troubleshooting across IT systems and infrastructures. Splunk has a Data Feed service that can be utilized by Chef.

Data Feeds

The Data Feed service sends node data to a third-party service. This can be useful when updating configuration management databases, external security dashboards and IT service management platforms.

The following types of information are sent:

• Ohai data gathered from each managed node
• Configuration information about each managed node
• Compliance information about each node that shows the compliance state

The client runs compliance reports, which the data feed service sends to the registered destinations every four hours (the interval is customizable). Please note that the aggregation will not happen if there are no destinations. Also, data is combined and transmitted in batches of 50 nodes at a time.

Setting Up Chef and Splunk Integration

First, download or use a trial version of Splunk from here. Next, follow the instructions below:

How to Create a New Splunk Data Feed in Chef Automate

• Navigate to the Integration Page of Automate UI: Head over to Settings > Data Feed > New Integration.

• Define Key Details:
  o Data Feed Name: Enter a unique name for the feed.

o URL: Input the endpoint URL for your Splunk feed, including specific port details.

• Set Up Authentication:
  o For Username and Password: Provide your Splunk login credentials.

o Alternatively, choose a token type for Access Token and input the token value.

• Test the Connection:
  o Validate by selecting Test Connection.

• Save the Feed:
  o Once successful, click Save to confirm the setup.

Configuring Global Data Feed Behavior

To modify Data Feed behavior with the available configuration settings, create a configuration patch file to update the configuration settings. Save this file in the .toml file format and name your file as desired.

For example, data-feed-patch.toml. To reflect the desired global Data Feed behaviour, include one or more configuration settings and their updated value(s) in your configuration patch .toml file.

Above is an example of data-feed-patch.toml. Here, we send data to Splunk every two minutes.

Find more details here.

To apply your configuration changes with the Chef Automate command-line tool: $ chef-automate config patch data-feed-patch.toml

Set Up an Index and Event Collector (HCE) on Splunk Cloud or Enterprise.

• To access your Splunk cloud account, use the endpoint URL for your Splunk feed and the Splunk login credentials you previously used in the Automate UI.
• Next, go to settings>indexes>new index. This is the directory where the logs will be stored.

• Next, go to settings>data inputs and create a data input by choosing the HTTP Event Collector (HEC).
• Click on the new token and configure it to receive data over HTTP. Select the previously made index to store incoming data as events.
• Finally, review the details and click on submit. Make sure you store the token for integration with Chef Automate.

Note: Verify you have all Tokens in the ‘Enabled’ state with other settings.

• Confirm the connection between Splunk and Automate by going to the "Search & Reporting" section and searching for index=cheflogs. You should see the validation message as an output.

Forward Automate Data to Splunk

Once you fill in all the above settings for both Automate and Splunk, the data will be sent to Splunk according to the defined global settings.

Example:

We are scanning two Linux machines and an AWS environment in this scenario. Based on their respective profiles, we create different scan jobs in Automate UI.

Per the Global setting, this data will be sent to Splunk every two minutes. To confirm this, log in to the Search & Reporting section and search for your index.

The picture above is raw data directly sent from Automate to Splunk. You can edit, modify or select entities based on your requirements. You can even use this data to construct a custom dashboard.

Integrating Chef Automate with Splunk empowers organizations with robust visibility into their infrastructure and compliance data, streamlining operations and improving decision-making. By centralizing the rich insights of Chef Automate within Splunk's powerful analytics platform, teams can easily monitor trends, identify anomalies and maintain compliance.

If you need more information or help integrating the above tools, don't hesitate to contact your Account Manager.