Installing and Configuring for Splunk Cloud

To install and configure the Ivanti Neurons for MDM Splunk app for Splunk Cloud:

1. Download mobileiron_cloud_for_splunk_cloud-2.2.0-bundle.tar.gz from https://support.mobileiron.com/support/CDL.html
   You will need your company's download/documentation credentials.

2. Log into Splunk Cloud in your web browser. Splunk sends the Splunk Cloud URL in an email.

3. Navigate to Settings > Indexes.

4. Check for the micloudaudittrails and miclouddevices indexes in the list.

5. If the indexes are not present, then click New Index, create the indexes as shown in the screenshots below, and then click Save.

   micloudaudittrails

   

   miclouddevices
   
   

6. Navigate to Apps > Manage Apps.

   

7. Select Manage Apps.
   
   

8. Select Upload App, providing Splunk Cloud credentials, accepting the Terms & Conditions check box, and logging in if prompted.

   

9. Follow the prompts on the page to upload the file mobileiron_cloud_for_splunk_cloud-2.2.0-bundle.tar.gz that you downloaded at the start of this process.

10. Wait until the Status column of the Uploaded apps page reflects Approved for the app that you just uploaded.

    

11. Click Installand then follow the prompts on the page to complete the installation.

12. Navigate to Settings > Data Inputs > Ivanti Neurons for MDM> Ivanti (under column Ivanti Neurons for MDM Splunk app Config).

13. Enable Fetch Data from Ivanti Neurons for MDM.

    

14. Configure the associated fields:

    • Ivanti Neurons for MDM admin URL Enter the URL to the target Ivanti Neurons for MDM instance. Ensure that you specify the entire URL with “https” included, for example, https://na2.mobileiron.com

    • Ivanti Neurons for MDM Read-only admin username: Enter the username of the Ivanti Neurons for MDM user with the Device Management and System Read Only roles that you created as part of the prerequisites.

    • Ivanti Neurons for MDM Read-only admin password: Enter the password of the Ivanti Neurons for MDM user with the Device Management and System Read Only roles that you created as part of the prerequisites.

    • Confirm password: Confirm the password.

    • Polling Interval: Select the amount of minutes to wait between fetching data.

15. Click Save.

16. Navigate to Settings > Server Controls > Trigger Rolling Restart.

    It is mandatory to trigger a rolling restart on saving or updating Data Input details.

    

    Server restart may require several minutes. Please do not upload the app or save data input again after triggering a rolling restart until the "Server is ready to execute triggered request, happy Splunking" appears in a search as described below in Checking server readiness.

17. Stark Splunking! Follow the instructions in Using the Ivanti Neurons for MDM App for Splunk Cloud/Enterprise.

Checking server readiness

Restart requires about eight minutes to reflect consistent data in the Splunk user interface. Do not upload the app or save data input again during this interval.

To check server readiness:

1. Wait eight to ten minutes after triggering the rolling restart, and then select Apps > Manage Apps > Ivanti Neurons for MDM >Search from the Splunk Cloud portal.

   

2. Enter the following search query:

   index="_internal" sourcetype=splunkd source="*splunkd.log"

   | transaction host startswith="*rolling restart* finished*" endswith="*happy Splunking*"

   | highlight "Server is ready to execute triggered request, happy Splunking*"

   Splunk Cloud may display the error, "Server Error" while the Server is restarting. If so, reload the page and retry.

3. Select Last 15 minutes, and then click the search icon.

4. Search for "happy Splunking" in the results.

More useful searches

This section describes more useful searches you can use to check on status.

Search for logs

Follow the same instructions as in Checking server readiness, this time entering the following query:

index="_internal" sourcetype=splunkd source="*splunkd.log" event_message="*mobileiron_cloud.sh*" | table _raw | sort _raw | reverse

Search for device index data

Follow the same instructions as in Checking server readiness, this time entering the following query:

index="miclouddevices"

Search for audit trail index data

Follow the same instructions as in Checking server readiness, this time entering the following query:

index="micloudaudittrails"