Splunk Setup Guide

Follow our step-by-step guide to integrate Fivetran logs into your Splunk monitoring system.

Prerequisites

To connect Splunk to Fivetran, you need:

• A account
• The edit_token_http permission to enable HTTP Event Collector (HEC)

NOTE: We support HEC on Splunk Enterprise platforms, including cloud and on-premise instances, and Splunk Cloud deployments.

---

In Splunk

NOTE: This step-by-step guide explains how to configure HEC on Splunk Enterprise. To learn how to do that on Splunk Cloud, refer to .

Enable HTTP Event Collector

Set up your HTTP Event Collector to configure a secret token that Fivetran can use to send data using HTTP and HTTPS.

1. Click Settings > Data Inputs.

2. Click HTTP Event Collector.

3. Click Global Settings.

4. Set the All Tokens toggle to Enabled.

   

5. (Optional) Select a Default Source Type for all HEC tokens.

6. (Optional) Select a Default Index.

7. (Optional) Select a Default Output Group.

8. (Optional) Check the Use Deployment Server checkbox to use a deployment server to handle configurations for HEC tokens.

9. (Optional) Check the Enable SSL checkbox to have HEC listen and communicate over HTTPS rather than HTTP.

10. (Optional) Enter a number in the HTTP Port Number field for HEC to listen on. Make a note of the port number. You will need it to configure Fivetran.

    TIP: Confirm that your firewall rules don’t block incoming and outgoing traffic through the port number.

11. Click Save.

12. Make a note of the Splunk instance that runs HEC. This is the Host you will need to configure Fivetran.

Create Event Collector Token

Configure a token to use HTTP Event Collector (HEC).

1. Click Settings > Add Data.
2. Click monitor.
3. Click HTTP Event Collector.
4. Enter a name for the token in the Name field. For example, Fivetran Logs.
5. (Optional) In the Description field, enter a description for the input and click Next.
6. (Optional) Confirm the source type and the index for HEC events.
7. Click Review.
8. Confirm that all settings are correct for the endpoint.
9. Click Submit.
10. Make a note of the secret token. You will need it to configure Fivetran.

(Optional) Create a Channel Identifier

If you have enabled indexer acknowledgement for the token you generated in , you must create a channel identifier which is unique (globally unique identifier). For more details about channel identifiers, see .

---

In Fivetran

1. Go to the .

2. Enter the Port and Host you found in .

3. Set the Enable SSL toggle to Enabled.

4. Enter the Secret Token you configured in .

5. (Optional) Enter the Splunk Channel Identifier you created in .

6. Click Save & Test. Fivetran will take it from here and sync your logs to Splunk.

---

Related articles