Hugh Kelley (Customer) asked a question.
Moving to OIE - what Splunk changes are required for log collection, authentication datamodel?
Our org is planning a move from Okta Classic to OIE. I am trying to understand how this impacts our Splunk log collection, searches, etc.
Is there a good doc/page that summarizes this? If not, can anyone provide insight about:
- Whether there is any need to change our existing collection method, Okta Identity Cloud Add-on for Splunk (built by Okta ) or switch to another app like the Splunk Add-on for Okta Identity Cloud (built by Splunk Inc.)
- Changes to log schema?
- Ways to map the Okta events into the Splunk Authentication data model
@Hugh Kelley (Customer) the article for your reference
https://support.okta.com/help/s/article/Exporting-Okta-Log-Data?language=en_US
https://splunkbase.splunk.com/app/6553
That article says:
Applies To
Does this mean there are no differences between OIE and OCE system logs, APIs, etc?
Did this plugin : https://splunkbase.splunk.com/app/6553 same as you installed before?