Cyber Chasse- Splunk Cloud Gateway

Splunk Cloud Gateway

Augmented Reality (AR) is for real-world circumstances and the computer-generated knowledge augments its components. 

 Augmented Reality is applied in various fields such as: 

· Marketing  

· Travel Navigation 

· Repair and Maintenance 

· Entertainment  

· Medical 

· Education, etc… 

In this post, let’s see how “Splunk Cloud Gateway” and its configuration are applied for Splunk AR. 

Splunk Cloud Gateway is a cloud-based overpass for mobile devices to link with on-premises Splunk Enterprise instance. As many people carry a mobile device these days, Splunk Cloud Gateway assists to fill the information gap with the help of dashboards on a mobile device. Splunk Cloud Gateway caters to the mobile application from Splunk Enterprise when Splunk Mobile is established on a mobile device. Splunk’s AWS-hosted Cloud Bridge is between the two applications. TLS 1.2 encryption protects the traffic between the mobile device and Splunk Enterprise. 

Architecture from Splunk 

Splunk Cloud Gateway

Splunk Cloud Gateway is a customary app found on Splunkbase. The link to download and document is given below: 

Splunkbase Software Download https://splunkbase.splunk.com/app/4250/ 
Splunk Cloud Gateway Documentation https://docs.splunk.com/Documentation/Gateway 

 
You can install using the User Interface (UI) or by opening the file to /etc/apps/. Splunk prompts for a restart when the installation is complete if downloaded through UI. Otherwise, you can restart Splunk as soon as the installation package gets unpacked in the Apps folder. 

Splunk Cloud Gateway appears as an app on Splunk Web post restart. Check the app to find the following pages in it: 

Splunk Cloud Gateway

The first page allows devices to manually register. When Splunk Mobile opens for the first time (or on an instrument not registered with any other Splunk Cloud Gateway instance), an activation code appears at the center of the display. This code is to register the apparatus on Splunk. The field “Device Name” can have any value, and this is to recognize a specific device. It helps to recognize the chief user of the device and its type. 

Splunk Cloud Gateway

Skipping over devices until they are registered, the next main section has the “Configure” tab. All deployment configurations are specified at the top of the page. The configuration file modifies the Cloud Gateway ID to reflect the environment better. For a Mobile Device Manager (MDM), download a configuration file. This is also the place to enable diverse products related to Splunk Connected Experiences. 

Splunk Cloud Gateway

In the Application section, search for Splunk Mobile. Under the Action column, choose Enable. Do this before registering a device. 

Select the apps from the App Selection Tab, based on a user’s preference to identify which dashboards should be seen through Splunk Mobile. Display all available dashboards when none of the apps are selected. Choose the desired apps by selecting them from the left panel, and find them on the right panel. Click save to commit the changes. 

Splunk Cloud Gateway

A couple of things to point out in this section. 

  • Apps management is based on the user and is not centrally managed. During a device registration, a user needs to log in to authenticate. The apps chosen on this page remain the same for all instruments registered under this user. 
  • Even if apps are mentioned, all dashboards aligned with global permissions remain visible to the user. 
  • To avoid all dashboards and restrict the viewable ones, it requires fixing all dashboards to app-only permissions and building a generic app without dashboards. No dashboards appear when this app is chosen and all dashboards are changed to app-only permissions. 
  • The last tab is the Splunk Cloud Gateway dashboard. This dashboard displays the app status and provides usage metrics. The top three panels are the most important while installing Cloud Gateway initially. If it doesn’t work properly, these three panels will assist in troubleshooting the service. 
Splunk Cloud Gateway

Splunk Mobile 

Google Play Store https://play.google.com/store/apps/details?id=com.splunk.android.alerts 
Apple App Store https://apps.apple.com/us/app/splunk-mobile/id1420299852 

 
The installation of Splunk Mobile on a mobile device is very simple. The app launch pops up a registration page once the app is ready. This page needs a code to register the instrument with Splunk Cloud Gateway. A secondary code is available below. This is to verify with Cloud Gateway, to ensure that the instrument is registered with the right encryption key. 
 

Splunk Cloud Gateway

With the above code, return to Splunk Cloud Gateway to register the instrument. From Splunk Mobile, type the activation code. Enter a device name, as elucidated above. Choose “Register” to continue. 

Splunk Cloud Gateway

Now the instrument is registered with Splunk Cloud Gateway. Authenticate the device name in the page Registered Devices. Ensure the Device Type, and its Owner matches the device and user. If necessary, use “Remove” to remove an instrument from Cloud Gateway. 

Splunk Cloud Gateway

The initial page shows the list of potential alerts from a mobile perspective. 

Splunk Cloud Gateway

Tap on “Dashboards” at the bottom of the screen to view the list of dashboards accessible to the mobile device. All Splunk dashboards that are available emerges in the list without any additional configuration. Select any dashboard. 

Splunk Cloud Gateway

For example, when you choose the Cloud Gateway Status Dashboard, the dashboard opens and at the top of the page, it shows a time-selector. You can see the panels in the UI in a single column on the mobile device. 

Splunk Cloud Gateway

Splunk AR 

Note: Currently Splunk AR feature supports only mobiles having iOS (apple mobiles). 

Apple App Store https://apps.apple.com/us/app/splunk-ar/id1420233757 

 
Registering mobile devices for Splunk AR is similar to registering a Splunk Mobile app. 

Splunk Cloud Gateway

Authenticate the device name in the page Registered Devices. Ensure that the Owner and the Device Type matches the user and device. If necessary, use “Remove” to remove an instrument from Cloud Gateway. 

Splunk Cloud Gateway

The Splunk>AR tab is to register the assets. Using Splunk AR, register an asset and connect it with a Splunk dashboard or AR workspace. You can scan an asset tag using a mobile device and see the associated data. With the barcodes present in the Splunk AR mobile app you can register assets. In Splunk Cloud Gateway, you can register existing barcodes and groups of assets, or obtain Splunk-generated QR codes or NFC tags. 

Splunk Cloud Gateway

For registering an asset in Splunk AR camera, you need to scan an asset tag using Splunk AR camera. 

Splunk Cloud Gateway

Click on Register’s new asset. Set an asset name and choose an asset display. Select AR workspace to connect the asset with augmented reality data, or Splunk Dashboard to connect a non-AR dashboard with the asset. 

Splunk Cloud Gateway

Post-registration of  New Asset, configure AR Workspace by choosing the dashboard. 

Splunk Cloud Gateway

Now type the AR Workspace Name. 

Splunk Cloud Gateway

The dashboard panels’ data populates the AR visualizations. Scan the asset tag to see the Splunk dashboard or AR workspace. Adjust the workspace as per require

ment and save. 

Splunk Cloud Gateway

If you still face issues related to this topic, feel free to post your queries in the Comment Box below and for more such interesting topics Follow us on 👍 Social Media. Happy Splunking >