Note the following prerequisites before installing the Splunk App for ECS.
Port Access: This app uses the ECS Management API which communicates on port 4443. This port must be opened for the Add-on to collect metrics from the ECS VDC.
Data Access Logs:
- For ECS 3.4 and earlier versions, an RPQ must be requested to configure data access forwarding on the ECS VDCs. Contact your local account teams to submit the RPQ.
- ECS 3.5 and later versions allow for easy configuration to export data access logs to an external SYSLOG target, without requiring an RPQ. This forwarding configuration is a requirement for enabling or using the ECS Splunk App.
- See the knowledge base article ECS How to Export ECS access logs to external SYSLOG target for instructions.
ECS Management User: We recommend creating a Management User from the ECS Web Portal with read-only (system monitor) privileges.
