Configure the Splunk Integration

​

Introduction

The Splunk integration connects Edge Infrastructure Services to a Splunk HTTP Event Collector (HEC) endpoint. After you set up the integration, you create data streams to control which platform data flows to Splunk — application logs, events, or metrics. Each data stream can be paused and re-enabled without deleting the configuration.

​

Prerequisites

• You have the SysAdmin role in your enterprise. See Manage Roles.
• A Splunk instance with an HTTP Event Collector configured and an HEC token available.

​

Add the Splunk Integration

1. In the header, select your profile avatar, then select Enterprise.
2. In the Enterprise Settings navigation, select Integrations.
3. Click Add Integration.
4. Complete all fields in the dialog:

   Field	Description
   Name	A descriptive name for this integration.
   Integration Category	Select Data.
   Integration Type	Select Splunk.
   HTTP Event Collector Token	The HEC token generated in your Splunk instance.
   Host	The hostname or IP address of your Splunk HEC endpoint.
   Port	The port your Splunk HEC listens on (typically 8088).
   URL Extension	The URL path for the HEC endpoint (typically /services/collector/event).
   Enable TLS	Select to encrypt the connection with TLS. Recommended for production deployments.
   Skip Verify	Select to skip TLS certificate verification. Use only in non-production environments.

   Alternatively, click Login to Splunk to authenticate with your Splunk instance and auto-populate the connection fields.
5. Click Add Integration.

The integration appears in the Integrations list. You can now create data streams to begin forwarding data.

​

Create a Data Stream

A data stream links a data source type to the Splunk integration. Each stream forwards one type of platform data. You can create multiple streams to forward different data types to the same integration.

1. In the header, select your profile avatar, then select Enterprise.
2. In the Enterprise Settings navigation, select Data Streams.
3. Select Create Stream.
4. Complete the following fields:

   Field	Description
   Name	A descriptive name for this data stream.
   Data Source Type	The type of platform data to forward: Application Logs, Events, or Metrics.
   Linked Integration	Select the Splunk integration you created.
   Enabled	Toggle on to activate the stream immediately after saving.

5. Select Create Stream.

Edge Infrastructure Services begins forwarding the selected data type to your Splunk instance.

​

Manage the Integration

​

Pause a data stream

To temporarily stop forwarding data without deleting the stream:

1. In the header, select your profile avatar, then select Enterprise.
2. In the Enterprise Settings navigation, select Data Streams.
3. Toggle the stream off. Toggle it on again to resume.

​

Update integration settings

The Integrations tab does not support editing an existing integration. To update connection details such as the HEC token or host, remove the integration and add a new one with the updated values. Re-link any data streams to the new integration after creating it.

​

Remove an integration

Click × Remove on the integration row in the Integrations tab. Remove any data streams linked to the integration first, or re-link them to a different integration, to avoid orphaned streams.

​

Next Steps