Migrate from Okta Identity Cloud Add-on for Splunk to the Splunk Add-on for Okta Identity Cloud

The Splunk Add-on for Okta Identity Cloud provides complete data collection parity with the Okta Identity Cloud Add-on for Splunk, and corresponding features except the following two adaptive response actions: 1) Updating user's lifecycle/status, 2) Add or Remove a user from a group.

In addition to this, Splunk built TA provides comprehensive CIM coverage, high reliability and multiple features and enhancements. Please see the Reference section of the documentation for more details.

The Splunk Add-on for Okta Identity Cloud provides support of the below-mentioned sourcetypes

• OktaIM2:log
• OktaIM2:user
• OktaIM2:group
• OktaIM2:app
• OktaIM2:groupUser
• OktaIM2:appUser

If you have already installed the Okta Identity Cloud Add-on for Splunk in a Splunk instance and want to install Splunk Add-on for Okta Identity Cloud in the same Splunk instance, you must first:

• Disable inputs for the Okta Identity Cloud Add-on for Splunk.
• Disable the Okta Identity Cloud Add-on for Splunk.

This prevents clashing of modinputs, data collection mechanisms, and the sourcetypes present in both add-ons.

To disable inputs for Okta Identity Cloud Add-on for Splunk, navigate to the Inputs page and select "Disable" in the dropdown for that add-on.

To disable the Okta Identity Cloud Add-on for Splunk, navigate to Apps > Manage Apps and select the "Disable" option for the add-on.

Once the Okta Identity Cloud Add-on for Splunk is disabled and Splunk Add-on for Okta Identity Cloud is installed, Users will need to Configure Credentials and Configure Inputs in the Splunk Add-on for Okta Identity Cloud to collect the data.

If both add-ons are enabled on the same Splunk instance you may experience data loss and errors.

Refer to "CIM compatibility of Okta System Logs" section of the document to view the CIM data models mapped with respective eventTpes of Okta System Logs in Splunk Add-on for Okta Identity Cloud