Configure the Splunk App for Edge Hub and AR

You can migrate Splunk AR deployment data, configure a Phantom instance to use Workflow Automation, and configure app-wide settings in the Settings page of the Splunk App for Edge Hub and AR.

Migrate Splunk AR deployment data

You can download and upload Splunk AR deployment data to migrate your data from one deployment to another. For example, you can move your Splunk AR data from a test environment to a production environment using the deployment data migration feature. Both Splunk App for Edge Hub and AR deployments must be the same version number.

Prerequisites

• You must have the ar_admin role or the ar_migrate_deployment_data capability to migrate Splunk AR deployment data.
• Make sure the Splunk App for Edge Hub and AR deployment that you're downloading data from is the same version number as the Splunk App for Edge Hub and AR deployment that you're uploading data to.

Download deployment data

First, download the deployment data you want to migrate from the Splunk platform instance its on.

1. Navigate to the Settings tab of the Splunk App for Edge Hub and AR in the Splunk platform instance that you want to download data from.
2. Click Download Deployment Data
3. Save the deployment data file.

Upload deployment data

Then, upload the deployment data that you downloaded to the Splunk Platform instance that you want to migrate to.

1. Navigate to the Settings tab of the Splunk App for Edge Hub and AR in the Splunk platform instance that you want to migrate to.
2. Upload the deployment data from the Splunk platform instance that you downloaded deployment data from.

Configure voice chat with Amazon Chime

Splunk AR users can voice chat, easily mute and unmute your microphone, and get voice signal levels in Splunk AR version 4.0.0 or higher with the Splunk App for Edge Hub and AR version 2.0.0 or higher. This voice chat experience uses the Amazon Chime SDK. You can use your own AWS account that has the Chime SDK, or you can use Splunk's access to Amazon Chime.

Enable voice chat with Splunk's access to Amazon Chime

To use Splunk's access to Amazon Chime, complete the following steps:

1. If you don't already have an AWS account, Create one here: https://aws.amazon.com/free.
2. In AWS, create a user with Secure Token Service (STS) access permission.
3. Contact sammyl@splunk.com and provide your AWS account ID and the username of the user you created with STS access.
4. Receive an External ID and Role Name.
5. Click Settings in the Splunk App for Edge Hub and AR.
6. Click Chime Configuration.
7. Enter the External ID and Role Name.
8. Enter your AWS account Access Key ID and Secret Access Key.
9. Click Add Chime Configuration.

See the following Amazon AWS documentation:

• https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html to learn how to create a user
• https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_change-permissions.html to learn how to add permissions

Enable voice chat if you already have access to Amazon Chime

If you're using your own AWS account that has Amazon Chime, you only need to provide your Access Key ID and Secret Access Key:

1. Click Settings in the Splunk App for Edge Hub and AR.
2. Click Chime Configuration
3. Enter your AWS account Access Key ID and Secret Access Key.
4. Click Add Chime Configuration.

Configure Workflow Automation

You can set up a Splunk Phantom instance to use Workflow Automation with your Splunk AR deployment. To learn more about Workflow Automation and how to enable it, see Enable Splunk AR Workflow Automation.

Disable or enable SSL certificate verification

Splunk AR requires an SSL certificate by default. You can disable SSL certificate verification in the Settings tab of the Splunk App for Edge Hub and AR.

Prerequisites

You must have the ar_admin role or the ar_manage_server_settings capability to disable or enable SSL certificate verification.

Disable or enable SSL certificate verification

1. Navigate to the Settings tab of the Splunk App for Edge Hub and AR.
2. Toggle SSL Certificate Verification to disable or enable it.
3. Restart your Splunk platform instance.