Splunk® Supported Add-ons

Splunk Add-on for Google Workspace

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Release notes for the Splunk Add-on for Google Workspace

Version 2.2.0 of the Splunk Add-on for Google Workspace was released on June 1, 2022.

About this release

Version 2.2.0 of the Splunk Add-on for Google Workspace is compatible with the following software, CIM versions, and platforms:

Splunk platform versions 8.0.x, 8.1.x, 8.2.x
CIM 4.20
Platforms Platform independent
Vendor Products Google Workspace Enterprise Plus

New features

Version 2.2.0 of the Splunk Add-on for Google Workspace contains the following new features.

  • Added the following new sourcetypes and CIM mapping support to event names:

sourcetype: gws:reports:calendar

  • event names:
    • change_calendar_acls
    • create_calendar
    • delete_calendar
    • create_event
    • delete_event
    • add_event_guest
    • change_event
    • restore_event


sourcetype: gws:reports:context_aware_access

  • event names:
    • ACCESS_DENY_EVENT


  • Updated existing sourcetypes and added CIM mapping support to event names:

sourcetype: gws:reports:groups_enterprise

  • event names:
    • invite_member


sourcetype: gws:reports:admin

  • event names:
    • CREATE_CALENDAR_RESOURCE
    • UPDATE_CALENDAR_RESOURCE
    • CHANGE_FIRST_NAME
    • CHANGE_LAST_NAME
    • CHANGE_USER_LOCATION
    • RESET_SIGNIN_COOKIES
    • DELETE_GMAIL_SETTING
    • DELETE_ROLE
    • REMOVE_PRIVILEGE
    • RENAME_ROLE
    • UNASSIGN_ROLE
    • DISALLOW_SERVICE_FOR_OAUTH2_ACCESS
    • ORG_LICENSE_REVOKE
    • USER_LICENSE_ASSIGNMENT


Token expiration Fix
When an activity report is running for more than 1 hour, the add-on reported a 401 status code while trying to make another request to the Google Workspace API. One of the potential scenarios that could lead to this issue - an input that was enabled, then stopped for a while and then reenabled. This caused the activity report input to gather all the data for that period of time (from when the input stopped until reenabling). The amount of data the add-on was trying to pull was too large for the 1 hour (API token expiration time) given to collect all that data.

Proxy improvements
This release brings in an improvement regarding the proxy support.

Fixed issues

Version 2.2.0 of the Splunk Add-on for Google Workspace fixes the following issues:


Date filed Issue number Description
2022-05-16 ADDON-50955 The issue occurs on Splunk Add-On for Google Workspace. The logs are missing intermittent and the Customer could see "HTTPError: 401 Client Error: Unauthorized for url "


Known issues

Version 2.2.0 of the Splunk Add-on for Google Workspace contains the following known issues. If no issues appear below, no issues have yet been reported:

Third-party software attributions

Version 2.2.0 of the Splunk Add-on for Google Workspace incorporates the following third-party software or libraries:

File:Splunk Add-on for Google Workspace third-party software credits.pdf

Last modified on 03 June, 2022
PREVIOUS
Source types for the Splunk Add-on for Google Workspace
  NEXT
Hardware and software requirements for the Splunk Add-on for Google Workspace

This documentation applies to the following versions of Splunk® Supported Add-ons: released


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters