# Splunk

Splunk is a software platform that helps organizations search, monitor, and analyze data from various third-party sources. Verkada allows users to build out efficient workflows to push information from their Command organizations into their Splunk instances through a built-in integration.

When you integrate Verkada with Splunk, it allows you to centralize and analyze your video surveillance data within the broader context of your operational data, which enables better insights and decision-making. You can use this implementation to bring in people and vehicle counts across all cameras in your organization, including device notifications.

{% hint style="danger" %}
Before you begin, you must have:

* An active Splunk instance with Admin access. Learn more about [Roles and Permissions for Command](https://help.verkada.com/command/users-and-permissions/roles-and-permissions-for-command).
* Org Admin permissions to your Verkada organization.
* A valid Verkada API key. Learn how to [generate a Verkada API key](https://apidocs.verkada.com/reference/quick-start-guide)
  {% endhint %}

There are 2 ways you can set up the integration:

* [Download and install the Splunk Enterprise software](#h_c45403a4de)
* [Download and install the software on Splunkbase](#h_7b8e057156)

***

## Download and install the Splunk Enterprise software

{% stepper %}
{% step %}
**Download the Splunk Enterprise software at** [**https://www.splunk.com/en\_us/download.html**](https://www.splunk.com/en_us/download.html)**. If you already have a Splunk Enterprise account installed and setup, proceed to step 4.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-27d568b9437f786dd81fc41ad22bea7895a12744%2Fb0b4d671eb8b15a22dd70cc0f7863e480d1f0580.png?alt=media" alt="" width="800"></div>
{% endstep %}

{% step %}
**Select the corresponding installation package, depending on the operating system you are running (Windows, Linux, or MacOS). We recommend downloading the .dmg package for an easier setup process.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-a8a0fafb73a04bdf350276b960fafb205d918acc%2F1332cff65c0be9eba2d4b1afc8f5bd9495023ade.png?alt=media" alt="" width="800"></div>
{% endstep %}

{% step %}
**Once the Splunk Enterprise package is installed, open the application. You should be redirected to a Terminal or PowerShell window where you can create your account credentials (username and password).**

​\
​**Important**: Keep these credentials. You need them (later) to log in to Splunk and set up the Verkada integration. Once you create your account, you should receive an email to verify your account. Be sure to check your inbox and complete this step before moving forward with the setup process.
{% endstep %}

{% step %}
**The Splunk application should open automatically after setting your username and password. Log in using the credentials you set up in step 3. If the Splunk Enterprise window does not open, navigate to the following URL to log in:**

​\
<http://localhost:8000/en-US/account/login?return\\_to=%2Fen-US%2Fapp%2Flauncher%2Fhome>

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-25f10b811ace459ea235723852a4709fd7601bf4%2F6a827e1ea61b8352384bf954cdf23d69c86d75ea.png?alt=media" alt="" width="753"></div>

The Splunk homepage is where all of your applications for various integrations, including Verkada, are managed and configured.
{% endstep %}

{% step %}
**At the top left, click the Apps dropdown and select Find more apps.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-a2a955feb0d1f518d69609c58de05c1398472852%2F4511f6dcd993eeee3fc6a7b836d8590af21cb938.png?alt=media" alt="" width="800"></div>
{% endstep %}

{% step %}
**On Browse More Apps:**

a. In the search box, enter **Verkada**. This returns 2 applications.\
b. Install the Verkada application that has been most recently updated (**verkada add-on**).\
c. Click **Install** for the Verkada app.

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-e9daf86c9bf313b8d98c366f862a1238e94c44b1%2Ff586f12f53d86fa8ada1454a8717eb01ac06ca51.png?alt=media" alt="" width="800"></div>
{% endstep %}

{% step %}
**On Login and Install:**

a. Enter your Splunk account credentials to verify your account.\
​\
​**Note:** These credentials are different from those created in step 3. To install the app, use the email and password used to log in to your general Splunk account. (<https://www.splunk.com/>).\
​\
b. Click **Agree and Install**.\
​

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-5e914ca4534f8cbb5a0270547c8852a5a03b7373%2F201110dae6331d0259dc1c9aae599f263c9f7ec0.png?alt=media" alt="" width="573"></div>
{% endstep %}
{% endstepper %}

***

## Download and install the software on Splunkbase

If the [above install method](#h_c45403a4de) does not work, there is an alternative way described here.

{% stepper %}
{% step %}
**Download the app at** [**https://splunkbase.splunk.com/app/6971**](https://splunkbase.splunk.com/app/6971)**.**
{% endstep %}

{% step %}
**Click Download to download the Verkada add-on application.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-cf73a5dd37605a85261072d98e2dba10be60318f%2F4a0ade8e13e3cdc253ccebfecf00651d5c6743bd.png?alt=media" alt="" width="800"></div>
{% endstep %}

{% step %}
**When the package is downloaded:**

a. Go back to your Splunk Enterprise account.\
b. Under the **Apps** dropdown, select **Manage Apps**.
{% endstep %}

{% step %}
**On Manage Apps, at the top right, click Install app from file.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-ac39d3dc4e6fb98f253be51203e8070cb708d7ac%2F796ba9a06c3d8a1af6bd5ef796afe5eb1b0ba159.png?alt=media" alt="" width="1727"></div>
{% endstep %}

{% step %}
**You are then redirected to a new page that prompts you to choose the install file for the application you want to add to your Splunk instance.**
{% endstep %}

{% step %}
**On Install App From File:**

a. Click **Choose File**.\
b. In your **Downloads** folder, find the recently downloaded file (**verkada-add-on\_126.tgz**).\
c. Select the file and click **Upload**.

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-4cd1805940530f86c3019c306ab1a1d71fa017ed%2F365b5eb4aaade37f2b3b0debd1f9a6e03d970535.png?alt=media" alt="" width="691"></div>
{% endstep %}

{% step %}
**Once the app is downloaded, under Apps, you should see the Verkada Add-On tab on your homepage.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-cd1e53e6da4deab95044e21bf4512aa1f1c51a88%2F86518f6e1eb46ddfd600a34d9a33684c64396e4e.png?alt=media" alt="" width="800"></div>
{% endstep %}

{% step %}
**Click the Verkada Add-On tab. This redirects you to a new page which is where you can set up and manage your Verkada integration.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-c451d5e6b4183e9c2759a85c993f5c3c4d25f269%2F8fbbaa95e1d7a5f330c6b0ac91e875cc2f2c246f.png?alt=media" alt="" width="1728"></div>
{% endstep %}

{% step %}
**On your Verkada App page, at the top right, click Add Input. This allows you to create 2 different types of inputs:**

* **verkada\_insights** provides the object-detection information for each camera in your organization. At regularly scheduled intervals, it displays the count for both people and vehicles that were detected, and the associated timestamp for those counts.
* **verkada\_notifications** provides the full list of all notifications generated by your Verkada devices.
  {% endstep %}

{% step %}
**Depending on your use case with Verkada’s Splunk integration, create a new input for verkada\_insights, verkada\_notifications, or both.**

​**Note**: To generate results for both options, you need to create 2 separate inputs for each feature.\
​
{% endstep %}

{% step %}
**Once you have selected your input, you are prompted to enter the following settings:**

a. Unique name for your data input\
b. Time interval (in seconds) for each processed input\
c. Index (recommended **default**)\
d. Your Verkada Command organization ID\
e. Your [Verkada API key](https://apidocs.verkada.com/reference/quick-start-guide).\
f. Click **Add**.

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-273f3f881a7cc9530da89611c1ce48a6ef9ef118%2Ff3b3951443c4709c218dee96417c4f56c99ac19e.png?alt=media" alt="" width="805"></div>
{% endstep %}

{% step %}
**Once you have added this new data input, you can see it under the Verkada app’s Input tab, with the corresponding name that you created in step 11.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-933a6a1f0dc4c531924b5758835fc653636ff332%2Fa49a0ae9705ad9c458bc086c1c0ac49f76bf5406.png?alt=media" alt="" width="800"></div>
{% endstep %}

{% step %}
**Verify that the integration is successful:**

a. Go to the **Search** tab.\
b. Enter **source="verkada\_insights"** or **source="verkada\_notifications"**, depending on the data input you configured.

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-be46f81429938ca747b9b54df00a358003890fdb%2F4d963af334d0dd2230567c12adc08fa741a2ae5f.png?alt=media" alt="" width="800"></div>

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-08ae67312b2787873b3d656e87e9e6dbaee39feb%2F0df48c46ff77364eada3fd42d2f17e97dc94d72e.png?alt=media" alt="" width="800"></div>

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-4755d90bf95767de61439bc9ccc3126ee6333994%2F1b5267abd0f312705a161c525bd061014efb782a.png?alt=media" alt="" width="1726"></div>
{% endstep %}
{% endstepper %}

***

## Troubleshooting

When updating from version 1.1.0 to version 1.2.6, there may be some new inputs which may not show up immediately. If this is the case, please follow the steps below to resolve the issue:

* Restart your Splunk instance and log back into your account.
* If all 3 inputs are still not showing up, delete and reinstall the Verkada Add-On App:
  1. Navigate to your Splunk Application directory.
  2. Delete the folder `SPLUNK_HOME/etc/apps/TA-verkada-add-on`.

     **Note:** You may need to restart your Splunk instance for the change to take effect.
  3. Proceed back to step 1 of this setup guide to download the Verkada Add-On application from Splunk.
  4. You should now see the new inputs under the Verkada application.

There may be other common issues that could lead to errors in data pulling:

* Expired Verkada API key.
* Incorrect Command Organization ID

For a more detailed view and understanding of ongoing integration issues, users can access the full Splunk logs located in `SPLUNK_HOME/var/log/splunk`. You can adjust the logging level in the add-on configuration tab.