Skip to content

Release notes for the Splunk Add-on for Google Workspace

Version 5.1.0 of the Splunk Add-on for Google Workspace was released on .

About this release

Version 5.1.0 of the Splunk Add-on for Google Workspace is compatible with the following software, CIM versions, and platforms:
Splunk platform versions 10.7, 10.6, 10.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3
CIM 5.x
Platforms Platform independent
Vendor Products Google Workspace Enterprise Plus

Version 5.1.0 expands audit activity collection and adds control over the collection delay for Gmail logs migrated to BigQuery. Gmail Logs Migrated queries include rows in the unpartitioned streaming buffer while retaining a filter on assigned partitions. This release also updates cryptography packaging and explicitly selects Python 3.9 for REST handlers to improve compatibility with supported Splunk platform runtimes.

New features

Version 5.1.0 of the Splunk Add-on for Google Workspace includes the following new features:

  • Adds Google Meet audit activity collection through the Activity input, using sourcetype gws:reports:meet.
  • Adds Google Workspace Secure LDAP audit activity collection, including bind, search, and unbind operations, through the Activity input, using sourcetype gws:reports:ldap.
  • Adds a configurable Lookback Offset to the Gmail Logs Migrated input. The default is 600 seconds (10 minutes), and values from 600 through 216000 seconds are allowed. Increase this value to give delayed BigQuery data more time to become available.

For Google Meet and Secure LDAP configuration, see Configure activity report data collection using Splunk Web. For Gmail configuration, see Configure Gmail headers data collection.

Existing Gmail Logs Migrated inputs without a Lookback Offset value continue to use 600 seconds. Increasing the offset increases collection latency and affects future queries only; it does not backfill events older than the saved checkpoint.

Fixed issues

Version 5.1.0 of the Splunk Add-on for Google Workspace fixes the following issues. If no issues appear below, no issues have yet been fixed.

Known issues

Version 5.1.0 of the Splunk Add-on for Google Workspace contains the following known issues. If no issues appear below, no issues have yet been reported.

Third-party software attributions

Version 5.1.0 of the Splunk Add-on for Google Workspace incorporates the following third-party software or libraries:

Third-party software attributions for the Splunk Add-on for Google Workspace