Showing results for 
Show  only  | Search instead for 
Did you mean: 

How to integrate DCRUM with Splunk and make custom reports work?


I am trying to test the Splunk intgration from DCRUm 12.4.2 and I cannot get the customer report to work and I am not seeing anything in any logs about why it may not be working. Does anyone have some guidance on better steps to troubleshoot?



Is my question that bad that nobody ahs any feedback on it? I was hoping someone had some info on trying this. I guess i will open a support ticket.

Hi Brian, sorry for keep you waiting that long. Here are 3 things I would check:

  • Is your report listed in the partner-export.yaml?
  • Is your report based only on cached data views. You would need to check that in the XML export. Only the following are supported:
    • CVENT.CVCache
    • CVENT.TierCache
    • CVENT.TierBaselineCache
    • CVENT.Trans
    • L2.L2
  • As data is not being pushed to Splunk, but rather pulled by an application deployed in Splunk, have you modified our demo app or wrote your own to pull the data? This is not required for Elastic, as data is being pushed there.

I'm guessing you've already seen this:

Hope that helps.