Integrate Apigee Sense alerts with Splunk

[dilipanvijay]

My question is in regards with integration Apigee Sense (Edge SaaS) with Splunk.

The intention is to create an Apigee endpoint that sends the Sense Alert payloads to Splunk through Message Logging policy .

Apigee supports payloads up to 10mb. How should we handle when Sense alert payloads exceed 10mb?

Or is there any other best ways to solution this.

Please share if there are any documentation/steps to integrate Apigee Sense with Splunk. 

[hartmann]

Hello @dilipanvijay 

Just as an FYI Apigee X supports payload sizes up to 30MB, which would mitigate the issue at hand (see more here: https://cloud.google.com/apigee/docs/api-platform/reference/limits)

For Apigee Edge specifically have you considered the use of streaming (which Splunk does support to/from their services per their documentation): https://docs.apigee.com/api-platform/develop/enabling-streaming - by utilizing streaming you can only perform a minimal set of operations in your proxy, but it would in theory help work around the 10 MB limits previously noted

Alternatively, you could utilize something like a signed URL: https://medium.com/google-cloud/handling-huge-payloads-using-apigee-and-google-cloud-storage-5fe44f4... and create a Splunk scripted input to consume the service/ingest the data as needed

Please let us know your thoughts - thanks!