Stream the audit events to Splunk

Send every audit event to a Splunk HTTP Event Collector as it happens.

In short

Connect a Splunk HTTP Event Collector once. Every audit event of the organization is then sent there, signed and retried.

Before you start

• Who: someone who may manage the organization's connections - owners and admins have it by default.
• Plan: the audit stream comes with the Enterprise plan, and the 14-day trial has it.
• First: in Splunk, Settings › "Data inputs" › "HTTP Event Collector": "Global Settings" turned on, and "New Token" made for {{brand}}.

Where it lives

1. Open your organization, then Settings › "Connections", and press "Stream the audit events".
2. Choose "Splunk". The wizard opens; each step is checked before the next one opens.
3. Read what you need and press "Next".
4. Type the "HEC address", such as https://splunk.example.com:8088/services/collector/event.
5. Optional: type the "Index" and the "Source type". Leave them empty for the token's defaults.
6. Press "Check this step", then "Next".

Sign in

1. In Splunk, "HTTP Event Collector", copy the token's "Token Value".
2. Paste it into "HEC token" and press "Check this step". {{brand}} sends one test event; it should show in Splunk with the action connection.test.
3. Press "Next".

Check and use

1. Press "Run the full check". It sends one more test event; every step should say Passed.
2. Check the "Name" and press "Finish". The audit stream shows under "Audit stream" with its health.
3. From then on every audit event is sent as it happens. "Deliveries" on the row lists what was sent and what the destination answered.

If a step fails

• "Test event" failed: the destination did not take the event. Check the address and the token or key, and that the index is among the token's "Allowed Indexes".
• "Where it lives" failed: the address is not https, or it is a private address your installation does not reach.
• Change what the step says and press "Check again". Closing the wizard keeps every step that passed; "Continue setup" on the row goes on.

Good to know

• Only audit events are sent - who did what and when, with the record's kind and id - never your records' content.
• Every page of events is signed and retried until the destination takes it. A destination that stays down turns the row's health to Down and says so.
• One audit stream per organization. To move it, disconnect it and connect the new one.
• Plan: the audit stream comes with the Enterprise plan, and the 14-day trial has it.

Related

• /help/settings/fix-a-company-connection
• /help/settings/scim-entra-id