Page History

Requesting a Splunk User Role (Obtaining a User Role)

The following steps provide instructions for requesting a Splunk user role:

Step 1:  If you do not yet have a HARP account or an EIDM or EUA account, click here to sign up for a HARP account.

Step 2:  Once your HARP account has been created, log in to HARP and request a QualityNet Splunk entitlement via a HARP User Role.

• Select Request a Role in HARP from the HARP homepage.

• On the Select a Program page, select QualityNet-Splunk
• On the Select an Organization page, select your Contract name (for contractors) or CMS Federal Employee (for CMS Federal employees)
• Don't see your organization listed?

• On the Select Roles page, select a QualityNet Splunk user role (choose one)
  • Splunk_SO
  • Splunk_User
• Click the Submit button
• Enter your reason for requesting the selected role in the Request Reason text field.
• Click the Submit button

Step 3: The organization's Security Official reviews and approves/denies the user role request. You will be notified via email that your request has been submitted, and again when your role has been approved or denied.

Step 4: Connect to the HCQIS network via Zscaler using your HARP Credentials. To obtain information on accessing Zscaler, please follow this link Zscaler Access, and click on the Get Started Tab to view the steps for requesting Zscaler.

Step 5: Log into Splunk https://splunkaws.hcqis.org:8000/ using your HARP credentials.

Requesting Application Log Ingestion or Splunk App Request

The following steps provide instructions for requesting application logs be ingested into a Splunk index to search and analyze data as well as create alerts, reports, and dashboards:

Step 1:  Login to ServiceNow at https://cmsqualitysupport.servicenowservices.com/ using your HARP credentials.

Step 2:  Locate Cloud request:

1. Type “catalog” in the Filter Navigator
2. Select IT Services Catalog
3. Select Cloud
4. Select Other Cloud Services
5. Select Other Cloud Services Request
6. Select Contract Name, Priority, and Need by date
7. For Service Request Details, provide information including the following:

• Hostnames, Hostname match, or IP range for inputs to be deployed
• Application log directories to be ingested (Splunk user on hosts must have read access to directories/logs)
• Index name to be used or created for ingestion
• Users or group required access to index
• If requesting a new Splunk add-on or application, please specify the name
• Upon completion of the request, please verify data is being ingested and accessible

Splunk is the data collection backbone for security operations to create a unified, interoperable security operations capability across all data centers.  

User(s) must have valid qualnet AD accounts. Splunk is not currently integrated with HARP or any other SSO provider.

Log into Splunk at https://splunkaws.hcqis.org:8000/ using your HARP credentials