chambear2809 Syslog, Web, And Proxy Supported Add-on Setup
Prerequisites
| Tool or access | Purpose | Verify |
|---|---|---|
| Bash and Python 3 | Run bundled setup and validation helpers | bash --version && python3 --version |
| Required product/platform access | Inspect or configure the selected target | Complete the documented preflight |
| Credential files for live modes | Keep secrets out of chat | Verify paths only |
Workflow Overview
┌───────────┐ ┌───────────────┐ ┌───────────────┐ ┌─────────────────┐
│ Preflight │ → │ Render/review │ → │ Apply/handoff │ → │ Validate evidence │
└───────────┘ └───────────────┘ └───────────────┘ └─────────────────┘
When to Activate
- Onboard, configure, render, or validate these web, proxy, DNS/DHCP, ADC, or appliance logs in Splunk.
- Preview and review the splunk syslog web proxy ta setup workflow before any live apply phase.
- Diagnose failed prerequisites, generated assets, configuration, or validation evidence.
Scope
Follow the documented read-only or render-first path whenever it is available. This skill does not imply permission to mutate live systems. Require explicit apply flags, protected credentials, and operator review for state changes.
Examples
Inspect the supported setup modes before selecting one:
bash skills/splunk-syslog-web-proxy-ta-setup/scripts/setup.sh --help
Expected output: usage, supported modes, and required arguments are displayed without changing the target environment.
Inspect validation modes before running completion checks:
bash skills/splunk-syslog-web-proxy-ta-setup/scripts/validate.sh --help
Expected output: offline, live, and completion options are displayed when the skill supports them; help exits without mutation.
Troubleshooting
| Issue | Cause | Resolution |
|---|---|---|
| Preflight fails | A required tool or access path is missing | Resolve it before rendering or applying |
| Rendered assets are incomplete | Required non-secret inputs are absent | Complete intake and render again |
| Apply is blocked | Review, credentials, or explicit acceptance is missing | Use the documented handoff |
| Validation is incomplete | Live evidence is unavailable | Record the gap and keep completion open |
TA Completion Gate
For every TA/add-on or dashboard companion run, satisfy the shared TA completion gate: configure and enable the data ingest path owned by this skill or its required companion, validate events or metrics in the target indexes/source types, and verify any pre-built/package-shipped dashboards are visible, macro-aligned, and returning data. If the package ships no dashboards, record that evidence explicitly and hand off dashboard use to the consuming app, ES/ITSI/ARI content, or readiness doctor.
Shared render-first workflow for parser and web/proxy add-ons where the primary work is transport ownership and exact package source-type stamping. Web-server profiles default to local file/Universal Forwarder monitors, IIS defaults to a Windows UF handoff, and network/proxy/security appliances default to SC4S or syslog handoff.
Tomcat is no longer a compatibility exception. As of August 20, 2026 Splunkbase
app 2911 designates 4.0.3 as current and advertises Splunk 10.5; that
package was downloaded, unpacked, and inspected here, so tomcat installs on a
10.5 Cloud stack through the default path. Older 4.0.x releases through
4.0.1 advertised versions only through 10.4, so do not pin below 4.0.3 on
10.5. The shared installer still refuses an app whose selected release does not
advertise the target platform before any mutation, and
--accept-unsupported-platform remains the only override — usable only when
vendor approval and the operator's exception record explicitly cover that package
and target.
Workflow
bash skills/splunk-syslog-web-proxy-ta-setup/scripts/setup.sh --render \
--products apache,nginx,iis,tomcat,haproxy,bluecoat --index web --syslog-index netproxy
Review inputs.local.conf.template for host-local file monitors and
transport-handoff.md for appliance/syslog profiles.
To install the selected packages through the shared installer after rendering:
bash skills/splunk-syslog-web-proxy-ta-setup/scripts/setup.sh --install \
--products apache,nginx,iis,tomcat,haproxy,bluecoat
bash skills/splunk-syslog-web-proxy-ta-setup/scripts/validate.sh --index web --syslog-index netproxy