[Logs] Updating Logpush to Splunk instructions and tutorial#768
Conversation
…al with new instructions
|
Sending separate review to SE to validate the tutorial steps as well. |
tlozoot
left a comment
tlozoot
left a comment
There was a problem hiding this comment.
Thanks Claire! Just a few minor comments.
|
Updated the files with review feedback, lmk what you think about the new task 2! |
tlozoot
left a comment
tlozoot
left a comment
There was a problem hiding this comment.
Looks great! Left one minor comment.
In a future change, we should also take a look at the rest of the Splunk instructions. We probably want to add some more fields than just the ones recommended here.
| Create the Logpush job by following the instructions on [Enable Logpush to Splunk](https://developers.cloudflare.com/logs/logpush/splunk). | ||
|
|
||
| You can enable or disable acceleration after the initial configuration by accessing the app Set up page by clicking the **Apps** dropdown, then **Manage Apps** > **Cloudflare Set Up**. | ||
| This API call creates a Logpush job but does not enable it. You will need to enable the Logpush job after setting the desired fields to push. Enable the job through the API by following the instructions on [Enable Logpush to Splunk](https://developers.cloudflare.com/logs/logpush/splunk) or through the Cloudflare dashboard by following these instructions: |
There was a problem hiding this comment.
Might be good to add a sentence to that effect of "You can't yet create a Splunk Logpush job in the dashboard. However, after creating the job, you can visit the dashboard to enable it or edit the fields used..."
There was a problem hiding this comment.
We try to avoid framing things from a negative standpoint (you can't do XYZ) and try to avoid hinting at future functionality because even if it'll be enabled next week, there might be a current-state user who's trying to follow these instructions. Slightly tweaking this section to clarify the process and highlight the dash more prominently.
|
I'd like Keith to review this (based on his comments in wiki/jira) but then I think this is good to merge. |
I sent him a PDF version of the steps to review separately and will wait to merge until I hear back from him! |
| 1. Login to your Splunk instance. | ||
| 2. Under **Apps** > **Find More Apps** search for _Cloudflare App for Splunk._ | ||
| 3. Click **Install**. | ||
| The final information you need is the endpoint to use to send the data to. The endpoint should be: |
There was a problem hiding this comment.
I think it would be helpful to mention to check whether it is using self-signed certificate or not around here, as it relates to one of the parameter in Logpush job for Splunk.
There was a problem hiding this comment.
Sohei, I addressed this by adding a new task for verifying whether it's using a self-signed certificate. I don't have steps for how to do that, though, if you happen to have that info!
There was a problem hiding this comment.
Looks good.
I think it is based on one of the config, like Enable SSL checkbox, similar to this I think: https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector
CC: @bharatnc
|
Woohoo! @crwaters16 ready to merge? |
Three days later thanks to TX power outages, but good to go!! |
Document the new SqlError class that wraps SQL query failures. Users can now distinguish SQL errors in their onError handler and access the failed query via the query property. Synced from cloudflare/agents PR #768 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
5 participants
No description provided.