Splunk (HEC)

Forward audit logs to Splunk via the HTTP Event Collector.

Prerequisites

1. Enable HEC on your Splunk instance.
2. Create a new HEC token (or reuse an existing one) with permission to write to the desired index.
3. Ensure network egress from your deployment to your Splunk host is allowed on the configured port.

Configuration fields

Field	Required	Description
Token	Yes	Your Splunk HEC token.
Host	Yes	Splunk hostname (e.g., splunk.example.com). Do not include the protocol — HTTPS is used automatically.
Port	No	HEC port. Defaults to 8088 if left empty.
Index	No	Target Splunk index. Defaults to mcp-s if left empty.
Anonymous Mode	No	Toggle to send only statistical data (see Anonymous Mode).

How it works

Logs are sent as JSON payloads to https://<host>:<port> with sourcetype set to audit_log and the source set to audit-logs.

Tips

• If your HEC uses TLS with a custom CA, configure your environment to trust it.
• Verify the token is active and has not been disabled in Splunk.
• Use a dedicated index to isolate audit logs from other data.

Troubleshooting

• Check HEC status and that the token is active and has permission to write to the target index.
• Confirm outbound egress to your Splunk host is allowed on the configured port.

If no logs appear at all, confirm the provider credentials and URL are correct and that outbound egress is allowed. See Log Settings for shared guidance.

Related

• Log Settings: retention, content options, and Anonymous Mode
• Logs: view and search the logs themselves