To enable Edge Processor on an existing Splunk Cloud stack or instance.

Applicability

Description

The Edge Processor solution is a data processing solution that works at the edge of the network. Use the Edge Processor solution to filter, mask, and transform data close to its source before routing the processed data to external environments.

The Edge Processor solution is suitable for Splunk Cloud Platform administrators who use forwarders or HTTP Event Collector (HEC) to get data into deployments. It is available on both Classic Experience and Victoria Experience. It can be used the Edge Processor solution if the Splunk Cloud Platform deployment meets the following requirements:

• • Runs Splunk Cloud Platform version 9.0.2209 and higher.
  • Is provisioned in a region that supports Edge Processor. See Available regions and region differences in the Splunk Cloud Platform Service Description.
• • Is provisioned in a cloud environment that does not use the DoD IL5 or FedRAMP Moderate subscription types.

By paring down and sanitizing data before sending it out to Splunk indexes or Amazon S3 buckets, can reduce data storage costs and help prevent confidential data from leaving the network. Edge Processor solution can also manage data processing configurations and monitor data ingest traffic through a centralized Splunk Cloud service.

Investigation

Get started with the Edge Processor solution

Start by verifying whether if it is access to the Edge Processor solution with the following:

1. Open a browser and navigate to https://px.scs.splunk.com/<tenant>, where <tenant> is the name of the Splunk Cloud Platform deployment.
2. Check whether the URL resolves to the same login page as the Splunk Cloud Platform deployment.

   • If the login pages are the same, then continue to the next step.
   • If the login pages are different, that means there is no access to the Edge Processor solution.
3. Log in to https://px.scs.splunk.com/<tenant> using a Splunk Cloud Platform user account that has the 'admin_all_objects' capability.

   • If the login succeeds and the browser redirects to the Data management page, that confirms there is access to the Edge Processor solution.
   • If it is encounters authentication errors or cannot access the Edge Processor service, that means there is no access to the Edge Processor solution.

Resolution

How to activate Edge Processor.

1. Request access to the Edge Processor solution

To request access to the Edge Processor solution, create a support case on the Splunk Support portal and complete the cloud change management (CCM) form. You'll need to specify the Splunk Cloud Platform deployment that you want to connect with the Edge Processor solution. 

This connection is required for provisioning the Edge Processor solution, since the Splunk Cloud Platform deployment must be used as the following:

• An identity provider for managing user accounts and logins for the Edge Processor service.
• A storage location for the logs and metrics generated by your Edge Processors.

Navigate to the Create a case page on the Splunk Support portal, and then complete the following steps:

2. Start using the Edge Processor solution

Once the previous step with the case request  is completed and you receive the access to Edge Processor, then continue with the next step.

Complete a one-time setup procedure to fully activate the Edge Processor service.

• See First-time setup instructions for the Edge Processor solution for more information.

Finally, configure your data sources to send data to your Edge Processor.

• For more guidance on getting started, see Quick start: Process and route data using Edge Processors.

For in-depth information about the Edge Processor solution, see the How the Edge Processor solution works chapter.

Related Links

About the Edge Processor solution

First-time setup instructions for the Edge Processor solution

Quick start: Process and route data using Edge Processors

How the Edge Processor solution works 

Available regions and region differences

Create a case