Splunk Integration¶

This guide covers how to configure Splunk integration with the Traceable Platform for SIEM connectivity.

Overview¶

Traceable Platform supports integration with Splunk to forward security events and notifications using Splunk's HTTP Event Collector (HEC).

Prerequisites¶

Splunk instance with HTTP Event Collector (HEC) enabled
HEC token generated in Splunk
Network connectivity from Traceable Platform to Splunk HEC endpoint

Configuration Steps¶

To integrate Splunk with Traceable, navigate to Integrations → SIEM/SOAR. Click on the Splunk card and fill in the following details:

Field	Description	Required
Integration Name	A descriptive name for the integration (e.g., `Splunk-Traceable Integration`)	Yes
Description	Optional description for the integration	No
Splunk HTTP Event Collector URL	The URL of your Splunk HEC endpoint (e.g., `https://http-inputs-<instance>.splunkcloud.com/services/collector/raw`)	Yes
Splunk API Token	The HEC token generated in Splunk	Yes

Example Configuration¶

Integration Name: Splunk-Traceable Integration
Splunk HTTP Event Collector URL: https://http-inputs-mizuhous.splunkcloud.com/services/collector/raw
Splunk API Token: <your-hec-token>

After entering the details, click Validate to test the connection. If successful, you will see "Test connection successful". Click Save to save the integration.

Splunk HEC Setup¶

Enable HTTP Event Collector¶

In Splunk, navigate to Settings → Data Inputs
Click on HTTP Event Collector
Click Global Settings and ensure HEC is enabled
Click New Token to create a new HEC token

Configure HEC Token¶

Provide a name for the token
Select the appropriate source type (e.g., traceable)
Select the index where events should be stored
Important: Uncheck "Enable Indexer Acknowledgement" to avoid "Data channel is missing" errors
Save the token and copy it for use in Traceable

Troubleshooting¶

For debugging Splunk integration issues, see Splunk Debugging Guide.

Support¶

For Splunk integration assistance, contact: support@harness.io