310-Customizing the Android Agent to Analyze Device Logs

You will want to analyze the data gathered from the devices that are registered with WSO2 EMM. Wondering how you can do this in WSO2 EMM?

WSO2 EMM uses Splunk to capture, index and correlate the real-time data into a searchable repository. Using the data in this repository you are able to generate graphs, reports, alerts, dashboards, and more.

Le's take a look at how you can configure Splunk with the WSO2 EMM Android Agent.

Clone the product-emm GIT repository. This will be referred to as <EMM_SOURCE_HOME> throughout this document.
```
git clone https://github.com/wso2/product-emm.git
```
Open the Constant.java file that is in the <EMM_AGENT_ANDROID>/utils directory.

<EMM_AGENT_ANDROID> refers to the <EMM_SOURCE_HOME>/modules/mobile-agents/android/client/client/src/main/java/org/wso2/emm/agent file path.
Define SPLUNK_PUBLISHER as the value for the string variable LOG_PUBLISHER_IN_USE.
```
public static final String LOG_PUBLISHER_IN_USE = SPLUNK_PUBLISHER;
```

Configure the fields shown below:

public final class SplunkConfigs {
  public static final String API_KEY = "<SPLUNK_API_KEY>";
  public static final String TYPE_HTTP = "HTTP";
  public static final String TYPE_MINT = "MINT";
  public static final String DATA_COLLECTOR_TYPE = TYPE_MINT;
  public static final String HEC_TOKEN = "<SPLUNK_HEC_TOKEN>";
  public static final String HEC_MINT_ENDPOINT_URL = "<SPLUNK_HEC_MINT_ENDPOINT_URL>";
}

Field	Description
API_KEY	Provide the Splunk API Key.
HEC_TOKEN	Provide the HTTP Event Collector token.
HEC_MINT_ENDPOINT_URL	Provide the HTTP Event Collector endpoint URL.

Apply the logcat operation on your device to push data to Splunk through WSO2 EMM.

For more information on applying an operation on your device, see Device Operations.