Register your mobile device to a Splunk instance

Register your mobile device or Apple TV in Splunk Cloud Gateway to connect to Splunk Enterprise or Splunk Cloud instances. Or, you can register your mobile device to a Phantom instance.

Prerequisites

• If you're registering to a Splunk Enterprise or Splunk Cloud instance, an admin must install Splunk Cloud Gateway on the search head.
• If you're registering to a Phantom instance, an admin must enable the mobile feature in the Administration page.
• The Connected Experiences app you're using is enabled in the Configure tab of Splunk Cloud Gateway by an admin.
• Have the cloudgateway role. See Configure Splunk Cloud Gateway and dashboard permissions.
• An admin must enable token authentication.
• Install a Connected Experiences app on your device.

Register a device with an authentication code using Splunk Cloud Gateway

Any user with the cloudgateway role can register a device. You do not need the admin role to register a device. Devices with a Connected Experiences app installed have a registration code in the app.

1. Log in to Splunk Cloud Gateway.
2. On the Register tab in Splunk Cloud Gateway, enter the 10-digit code provided by your mobile device or Apple TV.
3. Name the device.
4. Click Register.
5. Ensure that the confirmation code matches the confirmation code on the device.
6. Log in with your Splunk Enterprise credentials to complete registration.

Register a device if your organization uses SAML authentication

Register using the authentication code provided in the Splunk Mobile app.

If your organization uses both SAML authentication and an MDM provider, see Register your device if your organization uses both SAML authentication and an MDM provider

Prerequisites

• Download Splunk Mobile for iOS or Download Splunk Mobile for Android.
• Your admin has set up SAML authentication. See Set up SAML authentication for Splunk Cloud Gateway for in the Install and Administer Splunk Cloud Gateway manual for admin setup steps.

Steps

If your organization uses SAML authentication, register your device using the authentication code provided in the Splunk Mobile app. When you access your Splunk instance, you'll be redirected to your SSO provider. Log in and complete registration in Splunk Cloud Gateway.

Register a MDM-distributed device

If your admin set up Mobile Device Management (MDM) and in-app device registration, you can enter your Splunk login credentials to register your device. This feature is currently available for only Splunk Mobile for iOS and Android.

MDM allows admins to scale and further secure their Splunk Mobile deployment. To learn more about in-app registration, see About Mobile Device Management with Splunk Mobile.

If your organization uses both SAML authentication and an MDM provider, see Register your device if your organization uses both SAML authentication and an MDM provider

Prerequisites

• Download Splunk Mobile for iOS or Download Splunk Mobile for Android.
• Your admin has set up MDM and in-app registration.

For admin MDM set up, see Set up Mobile Device Management for iOS devices or Set up Mobile Device Management for Android devices.

Steps

If you're using an Android device and you've already registered to a Splunk instance using the authentication code, you must to unregister from the one you're currently using before you can register to an instance in the Splunk Mobile app.

Follow these steps to register your MDM-distributed device:

1. In the Splunk Mobile app, tap the Splunk instance that you want to register to.
2. Select Local or LDAP sign on.
3. Enter your Splunk instance credentials to register.

Alternatively, tap Register with Code to register using a provided authentication code and Splunk Cloud Gateway.

Register your device if your organization uses both SAML authentication and an MDM provider

If your organization uses both SAML authentication and an MDM provider, select SSO Sign On and log in with your organization credentials.

Register to multiple Splunk instances

You can get data from multiple Splunk Enterprise instances with multi-instance registration.

1. Navigate to Settings > Manage Instances. Or if you're using Splunk Mobile, tap the Cloud Gateway ID dropdown arrow.
2. Tap Edit > Register.
3. Follow the same registration steps as when you would normally register your device.

To navigate between Splunk instances in the Splunk Mobile app, tap the Cloud Gateway ID dropdown and select the instance that you want to view data from.

The Cloud Gateway ID is randomly generated when you first launch Splunk Cloud Gateway. You can define this Cloud Gateway ID in cloudgateway.conf to easily identify your Splunk instances. See Configure cloudgateway.conf in Install and Administer Splunk Cloud Gateway.

Unregister a device

You can unregister a device in Splunk Cloud Gateway or in the app on the device.

Here's how to unregister a device in Splunk Cloud Gateway.

1. Select the Devices tab in Splunk Cloud Gateway.
2. Next to device you want to remove, click Remove.
3. Click Remove.

Here's how to unregister a device in a Connected Experiences mobile app.

1. Tap the Cloud Gateway ID dropdown arrow.
2. Tap Edit.
3. Tap the X button next to the instance you want to unregister from.
4. Tap Unregister to confirm.

Register to a Phantom instance

To connect your device to a Phantom instance, register your mobile device using the authentication code in Splunk Phantom in Name > Account Settings > Mobile Device Registration.