Welcome to Splunk Secure Gateway 3.0

Splunk Mobile puts the power of Splunk in your hands. But with great power, comes great responsibility. That’s why this year with the release of Splunk Enterprise 9.0, we’ve shipped Splunk Secure Gateway (the backend service that powers Splunk Mobile) with even more features and tools to help you responsibly manage your mobile fleet.

ITSI Glass Tables for Splunk Enterprise

IT Service Intelligence (ITSI) Glass Tables provide you with the key metrics, network relationships and service dependencies that underpin your business. Previously, Glass Tables were only available on Splunk Mobile with cloud deployments. With the release of Secure Gateway (SSG) 3.0, we’ve unlocked the ability for on-premise customers to view and interact with Glass Tables on mobile as well. Check out this video to get a taste of what Glass Tables look like on Splunk Mobile.

Spacebridge Location

Spacebridge is the cloud service that routes data between your Splunk deployment and your mobile device. The default Spacebridge server is hosted in North America, but if your data can’t leave your region due to privacy laws or if you just want to reduce latency by avoiding data roundtrips, there’s a new solution for you.

This year we’ve made new Spacebridge servers available in Europe and Asia Pacific. An administrator setting up SSG 2.9+ will have the option to choose which Spacebridge server to connect to. During the onboarding process, administrators can view a list of possible Spacebridge locations and choose the best location based on their requirements. To make this process as easy as possible, the options menu will even highlight the recommended Spacebridge server based on the lowest latency. Watch this video to learn how to setup your Spacebridge location.

SAML

We know a lot of you use SAML Single Sign-On to authenticate with Splunk Mobile. But there are so many different SAML configurations and implementations out there. Whether you are using AQR or Scripted Authentication with the various different identity providers that we support, we wanted to make it super easy for you to ensure that your SAML authentication is configured properly.

To use SAML authentication, Splunk Mobile requires you to connect to your identity provider and enable tokens. Now, there is a brand new page on SSG where you can check the status of your identity provider connection and JWT tokens. If there is anything misconfigured, this page will point you to the issue and provide you with resolution instructions.  Admins can access this new page in Splunk Secure Gateway by selecting the Administration tab, and then SAML Configuration.

Troubleshooting

We know that your time is extremely valuable, so when SSG is not working as expected, we want you to get to the root of the problem as quickly as possible. That’s why we’ve built out a series of dashboards, like the Secure Gateway Status Dashboard and Recent Activities Dashboard, that allow you to monitor SSG activity, determine SSG status and ultimately diagnose any issues that come up.

If Splunk Mobile is not performing as expected, you should always start with the Secure Gateway Status Dashboard, which sums up all key parts of Mobile-to-SSG system. You should start your investigation from any panel that appears red on this dashboard.

If the Secure Gateway Status panel is red:

• Check Spacebridge connection, is a firewall/network permission interfering with the connection?
• Check what Spacebridge is in the instance_config KVStore collection in the nobody namespace for the Spacebridge server
• Try and curl Spacebridge

If the KV Store status panel is red:

• This is more of a Splunk issue, check the Health Status of your instance and follow Splunk’s suggested next steps

If the Websocket panel is red:

• Try and restart SSG’s modular inputs from the admin settings

If the HTTPS panel is red:

• Verify your SSL certificates, ensure HTTPS requests work on other websites (this is likely not an SSG issue)

Additionally, a list of the most recent errors on SSG will be available at the bottom of the Secure Gateway Status Dashboard.

If your dashboards take a long time to load on mobile, the Recent SSG Dashboard Activity dashboard is a good place to investigate. It lists all the requests that were made to the instance from mobile devices. Many requests coming in at once could hinder performance. At the bottom there’s a subscription section which will show you more info about a specific request.

See all these troubleshooting tools in action here. We hope each one on these troubleshooting dashboards makes you more confident that you’ll be able to solve any issues that come your way.

Next Steps

Can’t wait to get started with Splunk Mobile? Activate Splunk Secure Gateway following these instructions, and download the Splunk Mobile app via the following links:

• splk.it/ios
• splk.it/android

Looking to share your thoughts or suggestions with the Splunk Mobile team? Drop us an idea via Splunk Ideas. You can even speak with us directly by joining the Splunk Community Slack! We hang out in the #mobile and #splunksecuregateway channels and are always happy to help.

Last but not least, don’t forget to keep an eye out for more Connected Experiences blogs and review the past ones here.

This article was co-authored by Joe Mattekatt, Product Manager for Splunk Mobile Backend and Jesse Chor, VP of Engineering.

----------------------------------------------------
Thanks!
Jesse Chor