Skip to content

Monitor Resilio with Splunk

Feature availability

Splunk integration is available in Resilio 6.0 and newer.

You can monitor your Resilio deployment with Splunk using the resilio_reporting modular input app.

Prerequisites

Monitoring your Resilio deployment with Splunk requires:

  • An existing Splunk instance that can reach the Resilio Management Console API over HTTPS.
  • API feature enabled in your Resilio license.
  • The resilio_reporting app package.

Set up Splunk integration

To monitor your Resilio deployment with Splunk:

  1. Download and extract the resilio_reporting app package.

  2. Copy the entire resilio_reporting app folder to the Splunk apps directory.

    • Linux: /opt/splunk/etc/apps/resilio_reporting/
    • Windows: C:\Program Files\Splunk\etc\apps\resilio_reporting\

  3. Generate API token or enable JWT authentication via OAuth2 using Okta or Microsoft Entra ID:

    Important

    Use only one input stanza at a time. If both [resilio_reporting://api_token] and [resilio_reporting://oauth] are enabled, events will be duplicated.

    API token

    Important

    The API token must be tied to an administrator account with Super Administrator permissions to ensure access to audit logs. Note that this token can be used to access all Management Console's API endpoints, so it should be kept secure.

    1. In the Management Console, select Settings > API.
    2. Click + Create new token.
    3. Enter description, select an administrator account that will be tied to this token, then click Save.
    4. Copy the token value and use it in the next step.
    JWT authentication via OAuth2

    Setup integration with your identity provider to enable JWT authentication via OAuth2:

  4. Create local folder and inputs.conf file in it.

    • Linux: /opt/splunk/etc/apps/resilio_reporting/local/inputs.conf
    • Windows: C:\Program Files\Splunk\etc\apps\resilio_reporting\local\inputs.conf

  5. Open local/inputs.conf, copy configuration specific to your authentication method, and provide your Management Console URL along with authentication details.

    API token authentication 
    [resilio_reporting://api_token]
base_url = https://<YOUR_RESILIO_SERVER_HOST>:8446
api_token = <YOUR_API_TOKEN>
views = audit_logs_view,events_logs_view,file_events_view
query_limit = 10000
tls_verify = true
interval = 60
    JWT authentication via OAuth2 
    [resilio_reporting://oauth]
base_url = https://<YOUR_RESILIO_SERVER_HOST>:8446
oauth_token_url = https://<YOUR_IDP_HOST>/oauth2/token
client_id = <YOUR_CLIENT_ID>
client_secret = <YOUR_CLIENT_SECRET>
scope = <YOUR_SCOPE>
views = audit_logs_view,events_logs_view,file_events_view
query_limit = 10000
tls_verify = true
interval = 60

  6. Proceed with setting up your data input stream.

Configuration parameters reference

Parameter Description
base_url
Mandatory
 Replace with your Management Console address.
api_token
Conditional		 Replace with your API token if using token authentication.
Required when using token authentication.
oauth_token_url
Conditional		 OAuth2 token endpoint URL used with client_credentials flow.
Required when using OAuth2 authentication.
client_id
Conditional		 OAuth2 client identifier for your identity provider application.
Required when using OAuth2 authentication.
client_secret
Conditional		 OAuth2 client secret for your identity provider application.
Required when using OAuth2 authentication.
tls_verify
Mandatory		 Must be true in production unless you configure trust for an internal CA.
ca_cert
Optional		 Path to a custom CA bundle (PEM) on the Splunk host. If set, it takes precedence over tls_verify.
views
Optional		 Comma-separated list of views to collect.
Default: audit_logs_view,events_logs_view,file_events_view.
query_limit
Optional		 Maximum rows per request.
Default: 10000.
Note: 10000 is also the maximum allowed value.
interval
Optional		 Collection interval in seconds.
Default: 60.
scope
Optional		 Optional OAuth2 scope.

tls_verify

Keep tls_verify=true in production. If the server uses an internal or self-signed CA, configure ca_cert instead of disabling TLS verification.

Data collection and troubleshooting

  • The app collects:
    • audit_logs_view - System and Agent management audit logs.
    • events_logs_view - System events log.
    • file_events_view - File transfer and file management events.
  • The app defines the resilio index by default.
  • Collection checkpoints (last SeqId) are stored per view in Splunk checkpoints, so collection resumes after restart without duplicates.

Search collected data:

index=resilio sourcetype IN (resilio:audit_logs_view, resilio:events_logs_view, resilio:file_events_view)

Search input errors:

index=_internal source=*splunkd.log* resilio_reporting