Splunk integration

Data export Data export actions

The Splunk integration lets you forward data to your Splunk Cloud or enterprise instance for further analysis with Splunk’s HTTP Event Collector (HEC). This lets you leverage HUMAN data alongside your existing logs and metrics within your Splunk platform. You can use the Splunk integration to create a data export or trigger it with a data export action.

Prerequisites

• Appropriate role permissions to create and manage integrations

Integrate with Splunk

1. Navigate to Platform Settings > Integrations and click the Splunk integration.
2. Click Add Integration.
3. Provide the following:
   • Integration name: How the integration will appear in your HUMAN account.
   • Authentication method: Select the authentication method for sending data.
     • If you select Web application firewall (WAF), also provide allowed IPs.
   • URL: The Splunk URL to send data to. This should follow Splunk’s HEC URI standard form for Splunk Enterprise: <protocol>://<host>:<port>/<endpoint>. See Splunk’s Set up and use HTTP Event Collector in Splunk Web for more information.
   • Protocol: The HTTP protocol to use.
   • Provide an SSL certificate: If you select TLS, upload a CRT file of your SSL certificate.
   • Headers (optional): Add any header names and values as needed. If any duplicate header keys are provided, the webhook will only send the later one.
     • If you are adding the Authorization header, you must include the keyword Splunk before the HEC token.
4. Click Test Connection.
5. Once the test succeeds, click Save changes.

You have successfully configured a Splunk integration. Make sure to use the integration to create a data export or trigger it with a data export action.