Skip to content

Splunk

SailPoint Entro integrates with Splunk Cloud by utilizing Splunk's HEC - HTTP Event Collector and SailPoint Entro's Webhooks Mechanism.

Creating the HEC

  1. In your Splunk instance, click on the Settings and select Add Data

  2. Select Monitor

  3. Select HTTP Event Collector

  4. Fill in the details and click on Next

  5. Leave the source type as Automatic, you can also configure the index where you would like your data to be stored. Click Review.

  6. The final result should look roughly the same, click on Submit -

  7. Copy the generated token

Sending Data

You must satisfy all the following conditions when you send data to HEC:

  • HEC must be enabled

  • You must use an active token to authenticate into HEC

  • Have a formatted Splunk HEC URL

Splunk Cloud Platform URL

You must send data using a specific URI for HEC.

The standard form for the HEC URI in Splunk Cloud Platform free trials is as follows:

<protocol>://<host>.splunkcloud.com:<port>/services/collector/raw

The standard form for the HEC URI in Splunk Cloud Platform is as follows:

<protocol>://http-inputs-<host>.splunkcloud.com:<port>/services/collector/raw

The standard form for the HEC URI in Splunk Cloud Platform on Google Cloud is as follows:

<protocol>://http-inputs.<host>.splunkcloud.com:<port>/services/collector/raw

The standard form for the HEC URI in Splunk Cloud Fedramp Moderate on AWS Govcloud is as follows:

<protocol>://http-inputs.<host>.splunkcloudgc.com:<port>/services/collector/raw

Where:

  • <protocol> is either http or https

  • You must add http-inputs- before the on AWS.

  • You must add http-inputs. before the on GCP and AWS Govcloud.

  • <host> is the Splunk Cloud Platform instance that runs HEC

  • You must add the .splunkcloud.com domain after the <host>

  • <port> is the HEC port number

    • 8088 on Splunk Cloud Platform free trials

    • 443 by default on Splunk Cloud Platform instances

  • For the endpoint, in our case, you will use the /services/collector/raw

Splunk Enterprise URL

The standard form for the HEC URI in Splunk Enterprise is as follows:

<protocol>://<host>:<port>/services/collector/raw

Where:

  • <protocol> is either http or https

  • <host> is the Splunk instance that runs HEC

  • <port> is the HEC port number, which is 8088 by default, but you can change in the HEC Global Settings

  • For the endpoint, in our case, you will use the /services/collector/raw

Splunk authorization header structure

Authorization: Splunk <hec_token>

In SailPoint Entro

Head over to Settings → Webhooks

Create a custom webhook and fill in the form details as below.

More on Splunk HEC from Splunk's website-