Setting Up a Splunk REST Connection Manager
The REST Connection Manager is an SSIS connection manager that can be used to establish connections and facilitate data integration with REST-based APIs and services such as Splunk, among many more.
Integration for Splunk is enabled by the following two components:
To add a new connection, right-click the Connection Manager area in your Visual Studio project, and choose "New Connection..." from the context menu. You will be prompted the "Add SSIS Connection Manager" window. Select the "REST (KingswaySoft)" item to add a new REST Connection Manager.
The REST Connection Manager contains 3 pages of configuration.
- General
- Advanced Settings
- Custom Headers
General Page
The General page allows you to specify connection properties and login credentials for the Splunk REST service:
- Service Name
-
The REST service to which it will be connected.
- Instance Type
-
The Instance Type can be chosen as Splunk Enterprise or Splunk Cloud Platform based on the instance you are connecting to.
- Instance Name
-
The name of the Splunk instance to connect to.
- API Base URL
-
The API Base URL to use when making API requests.
- Port (API)
-
The Port option allows you to specify the port number for the connection (default is 8089).
- HEC Base URL
-
The HEC Base URL to use when making Splunk HTTP Event Collector (HEC) requests.
- Port (HEC)
-
The Port option allows you to specify the port number for the connection (default is 8088).
- HEC Token
-
The token used to authenticate with the Splunk HTTP Event Collector (HEC).
- API Throttle Rate
-
The API Throttle Rate will limit the number of requests that can be sent per minute. Set this value to 0 to disable API Throttling.
- Authentication Mode
-
The Authentication Mode option allows you to specify how to authenticate with the Splunk server. Available options are:
- Basic
- Session
- API Token
- Username
-
The Username of the account you wish to use to connect to your Splunk instance. This field is only available when the Authentication Mode is set to Basic or Session.
- Password
-
The Password of the account you wish to use to connect to your Splunk instance. This field is only available when the Authentication Mode is set to Basic or Session.
- API Token
-
The API Token that will be used to connect to your Splunk instance. This field is only available when the Authentication Mode is set to API Token.
- Test Connection
-
After all the connection information has been provided, you may click the "Test Connection" button to test if the user credentials entered can connect to the selected REST service.
Advanced Settings Page
- Proxy Mode
-
The Proxy Mode option allows you to specify how you want to configure the proxy server settings. There are three options available:
- No Proxy
- Auto-detect (Using system-configured proxy)
- Manual
- Proxy Server
-
Using the Proxy Server option allows you to specify the name of the proxy server for the connection.
- Port
-
The Port option allows you to specify the port number of the proxy server for the connection.
- Username (Proxy Server Authentication)
-
The Username option (under Proxy Server Authentication) allows you to specify the proxy user account.
- Password (Proxy Server Authentication)
-
The Password option (under Proxy Server Authentication) allows you to specify the proxy user's password.
Note: The Proxy Password is not included in the connection manager's ConnectionString property by default. This is by design for security reasons. However, you can include it in your ConnectionString if you want to parameterize your connection manager. The format would be ProxyPassword=myProxyPassword; (make sure you have a semicolon as the last character). It can be anywhere in the ConnectionString.
- Timeout
-
The number of seconds requests should wait before timing out.
- Retry on Intermittent Errors
-
The retry on intermittent errors option determines if requests will be retried when there is an error. If this option is checked, requests will be retried up to 3 times.
- Ignore Certificate Errors
-
This option can be used to ignore those SSL certificate errors when connecting to Splunk servers.
-
Warning: Enabling the "Ignore Certificate Errors" option is generally NOT recommended, particularly for production instances. Unless there is a strong reason to believe the connection is secure, such as the network communication is only happening in an internal infrastructure, this option should be unchecked for best security.
Custom Headers Page
The Custom Headers page will allow you to set the Header Name and Header Value. You may select the green icon to add another row, and the red icon to remove an existing header you have configured.