Skip to content

Migrate from Okta Identity Cloud Add-on for Splunk to the Splunk Add-on for Okta Identity Cloud

The Splunk Add-on for Okta Identity Cloud provides complete data collection parity with the Okta Identity Cloud Add-on for Splunk, and corresponding features except the following two adaptive response actions:

  1. Updating user’s lifecycle/status.
  2. Add or Remove a user from a group.

In addition to this, Splunk built TA provides comprehensive CIM coverage, high reliability and multiple features and enhancements. Please see the Reference section of the documentation for more details.

The Splunk Add-on for Okta Identity Cloud provides support of the following sourcetypes:

  • OktaIM2:log
  • OktaIM2:user
  • OktaIM2:group
  • OktaIM2:app
  • OktaIM2:groupUser
  • OktaIM2:appUser

If you have already installed the Okta Identity Cloud Add-on for Splunk in a Splunk instance and want to install Splunk Add-on for Okta Identity Cloud in the same Splunk instance, you must first:

  • Disable inputs for the Okta Identity Cloud Add-on for Splunk.
  • Disable the Okta Identity Cloud Add-on for Splunk.

This prevents clashing of modinputs, data collection mechanisms, and the sourcetypes present in both add-ons.

To disable inputs for Okta Identity Cloud Add-on for Splunk, navigate to the Inputs page and select Disable in the dropdown for that add-on.

To disable the Okta Identity Cloud Add-on for Splunk, navigate to Apps > Manage Apps and select the Disable option for the add-on.

Once the Okta Identity Cloud Add-on for Splunk is disabled and Splunk Add-on for Okta Identity Cloud is installed, users must Configure Credentials and Configure Inputs in the Splunk Add-on for Okta Identity Cloud to collect the data. Account configurations from the Okta Identity Cloud Add-on for Splunk are not migrated automatically, so recreate the account and any required inputs in Splunk Add-on for Okta Identity Cloud before enabling collection.

If both add-ons are enabled on the same Splunk instance you may experience data loss, missing sourcetypes, and ingestion errors. After validating collection in Splunk Add-on for Okta Identity Cloud, remove the Okta Identity Cloud Add-on for Splunk from the instance.

Refer to “CIM compatibility of Okta System Logs” section of the document to view the CIM data models mapped with respective eventTypes of Okta System Logs in Splunk Add-on for Okta Identity Cloud.