Skip to main content
Code42 Support

Install and manage the Code42 app for Splunk

Applies to:
  • Code42 CrashPlan (previously CrashPlan PROe)

Overview

This tutorial explains how to install, manage, and uninstall the Code42 app for Splunk version 1.1. It also provides basic troubleshooting information.

This version of the Code42 app for Splunk is supported for use with Code42 environments version 4.2.x through 4.3.x. For information on later versions, see Installing And Managing The Code42 app for Splunk In Version 5.x.

Considerations

  • You must have an existing Splunk Enterprise environment to use the Code42 app for Splunk.
  • Code42 cannot provide technical support for Splunk Enterprise. Contact Splunk for help with Splunk Enterprise.
  • The device(s) used to run Splunk Enterprise and the Code42 app for Splunk must have network access to the enterprise server on port 4285 (HTTPS) or 4280 (HTTP). Port 4285 is the default port.

Available versions

Code42 app for Splunk Version Supported Code42 environment Version

Code42 app for Splunk version 2.1.x

Version 5.1.x and 5.3.x

For more information, see Installing And Managing The Code42 app for Splunk In Version 5.x.

Code42 app for Splunk version 1.1

Versions 4.2.x, 4.3.x, 5.0.x

Before you begin

  1. Install Python 3 on the device(s) used to run Splunk Enterprise and the Code42 app for Splunk.
  2. Install the following required Python modules:
  3. Prepare a user account in your Code42 environment for configuring the Code42 app for Splunk.This user is used to authenticate and access data in your Code42 environment.
    • Permissions: The Code42 app for Splunk returns data based on the permission level of the role assigned to this user. The SYSADMIN role provides access to data for your entire Code42 environment. If your user’s role has more restrictive permissions, we recommend testing the user permissions to confirm that they can access the desired data.
    • Licensing: As a best practice, we recommend creating a user in your Code42 environment that is exclusively used to configure your Code42 app for Splunk. This way, configuration of your Code42 app for Splunk isn’t tied to a particular individual. Users without a CrashPlan archive will not consume a license.

Installing the Code42 app for Splunk

Step 1: Download and install the Code42 app for Splunk

  1. Download version 1.1 of the Code42 app for Splunk.
  2. From your Splunk Enterprise server's home page, click the Manage Apps button: Manage Apps button
  3. Click Install app from file.
  4. Click Choose File.
  5. Select the Code42 app for Splunk (code42.spl).
  6. Restart your Splunk Enterprise server to complete the installation.

Step 2: Configure the Code42 app for Splunk

  1. Sign in to Splunk Enterprise as an administrator.
    Splunk Enterprise displays a confirmation message:
    Message - setup required
  2. Click Set up now when prompted.
  3. Enter the full hostname or IP address of your master server in the Console Hostname field.
  4. Enter the port used by your master server in the Console Port field.
    The default port used by your master server is 4285.
  5. Enter the credentials of the Code42 platform user that you want to use to authenticate with your master server in the Console Username field.
  6. Enter the user's password in the Console Password field.
  7. Confirm the user's password.
  8. Click Save.
    Splunk Enterprise displays the Apps management screen.

Step 3: Test the Code42 app for Splunk

  1. Go to the home page of your Splunk Enterprise server.
  2. Click on the Code42 app for Splunk app icon:
    Code42 app icon
  3. Explore the data generated by the panels.

Managing the Code42 app for Splunk

Adding additional data sources

You can add additional data sources to Splunk, such as log files or Code42 API resources.

SSL certificate validation

If your master server uses a self-signed certificate, you can optionally disable SSL certificate validation to avoid displaying an error.

  1. Click Manage Apps:
  2. Click the Set up link for the Code42 app for Splunk.
  3. Disable Require SSL certificate validation.

Troubleshooting the Code42 app for Splunk

  • Data may not appear in the panels immediately. Rather, data will update at scheduled intervals. The scheduled intervals are configured to avoid overloading your master server with requests.
  • If data for a panel is missing, confirm that the Code42 environment user account has the necessary permissions to view that data within your Code42 environment.
Code42 app for Splunk location
To use the commands and paths listed below, you must know the path to your Code42 app for Splunk installation, which varies by platform. The path to the Code42 app for Splunk installation is referred to as <path-to-splunk> below. See the Splunk Enterprise documentation for the default installation directory for your operating system.

Logs

The Code42 app for Splunk updates a log file that contains useful information for troubleshooting, including error messages and security warnings. The log file is located at:
<path-to-splunk>/etc/apps/code42/log/code42.log

Upgrading the Code42 app for Splunk

When a new version of the Code42 app for Splunk comes out, you can upgrade to the latest version by following these steps:

  1. Sign in to Splunk Enterprise.
  2. From your Splunk Enterprise server's home page, click Manage Apps: Manage Apps button
  3. Click Install app from file.
  4. Select Upgrade app. Checking this will overwrite the app if it already exists.
  5. Browse to the file containing the latest version of the Code42 app for Splunk.
    For example: code42_2.1.spl.
  6. Select and open the file.
  7. Click Upload.
    The file is processed.
  8. Click Restart Splunk.
  9. Click OK to restart Splunk.
    Splunk restarts, and the new version of the Code42 app for Splunk is available.

Uninstalling the Code42 app for Splunk

  1. Open a terminal window (Linux or OS X) or command prompt (Windows) on your Splunk Enterprise server.
  2. Run the following command to stop Splunk Enterprise:
    <path-to-splunk>/bin/splunk stop
  3. Run the following command to remove the Code42 app for Splunk:
    <path-to-splunk>/bin/splunk remove app code42
  4. (Optional) To completely remove all data related to the Code42 app for Splunk, clear its index:
    <path-to-splunk>/bin/splunk clean eventdata -index code42