What this connection does

Splunk HEC is an outbound destination for tenant-scoped audit events. EmDash sends new events after the destination is activated, in batches where possible, and uses stable event identifiers so retries do not create duplicate logical exports.

Prerequisites

  • A user with integrations:manage to save, test, enable, pause, resume, disable, or rotate the destination. integrations:read can view configuration status and delivery health.
  • A Splunk administrator who can create an HEC token and permit requests from EmDash.
  • An HTTPS HEC ingestion hostname reachable from the public internet. Do not use an HTTP URL, a private address, embedded credentials, or a URL containing a token.
  • The target Splunk index and, if your search conventions require them, a source, sourcetype, and optional host.
  • The HEC token value available for one-time entry in the form. EmDash never displays it again after saving.

Configure Splunk HEC

  1. In Splunk, create or identify an active HEC token with permission to write to the intended index. Copy the HEC ingestion endpoint shown in the token or data-input setup page; do not derive it by editing another Splunk URL.
  2. In EmDash, open Settings → Integrations and select Splunk HEC.
  3. Enter the HTTPS HEC endpoint (base URL). Enter only the scheme, hostname, and any port shown by Splunk. Do not enter /services/collector, /services/collector/event, or /services/collector/health; EmDash appends /services/collector for its authenticated connection test and deliveries. For Splunk Cloud, use the hostname form for your deployment type:
    • Free trial: https://inputs.<stack>.splunkcloud.com:8088
    • Paid AWS: https://http-inputs-<stack>.splunkcloud.com:443
    • Paid Azure or Google Cloud: https://http-inputs.<stack>.splunkcloud.com:443 Copy the exact hostname and port supplied by Splunk. Do not manually remove si-i- or any other prefix from a URL. For the free-trial stack prd-p-lpett, the base URL is https://inputs.prd-p-lpett.splunkcloud.com:8088.
  4. Enter the Index, and review Source (default emdash) and Sourcetype (default emdash:audit). Add Host only if your Splunk searches require one.
  5. Enter the HEC token. When rotating a token later, re-enter the replacement; the existing secret is write-only.
  6. Enable Indexer acknowledgement only when it is enabled and supported by your HEC deployment. The setting is a boolean and should match Splunk’s configuration.
  7. Select Save, then Test connection. A destination cannot be enabled until a valid secret is configured and the test succeeds.
  8. Select Enable and confirm the page shows enabled state and recent delivery health. Use Pause or Disable when you need to stop new exports.

Delivery and retention

Exports contain redacted audit metadata, not access tokens, message bodies, attachments, or investigation evidence. Delivery starts with events created after activation; there is no automatic historical backfill. Transient HEC failures retry with backoff and eventually appear in delivery health or a dead-letter state for investigation.

Permissions and data boundaries

The HEC token is encrypted and retained server-side. The browser receives only whether a secret is configured, never the token itself. Destination and event access is tenant-scoped, and only users with the integration-management permission can change delivery state.

Troubleshooting

  • Test authentication failed: check the token, HEC token status, index permission, and endpoint URL. Rotate by entering a new token; do not paste it into a support request.
  • HEC health returns code: 17: this means the HEC health endpoint is available and accepting input. It does not prove that the token can write to the selected index. Run the EmDash connection test after configuring the token and index. Splunk documents the health endpoint separately from the event collector endpoint.
  • Connection test failed (526): this is a TLS certificate validation failure between EmDash and the configured host. Confirm that the exact HEC hostname is covered by the certificate, that the hostname is not a management/search URL, and that the port is supported. Do not work around this by switching to HTTP or by entering a different hostname that merely loads in a browser.
  • Connection test failed (530), error code 1016: this is a DNS or routing failure. Verify that the exact HEC hostname copied from Splunk resolves in public DNS and does not depend on a VPN, private DNS zone, private link, or an internal-only alias. A malformed hostname such as one created by manually removing si-i- can produce this error. dig +short <hec-host> is a safe DNS check; never include the token.
  • Free-trial HEC still fails with 526: some free-trial inputs.<stack>.splunkcloud.com:8088 endpoints serve Splunk’s self-signed/default certificate. A browser or curl -k health check can still return code: 17, but EmDash requires a publicly trusted certificate and will reject that endpoint. Ask Splunk to provision a public HEC endpoint with a valid certificate; EmDash cannot disable certificate verification.
  • Endpoint rejected: use the exact public HEC ingestion hostname supplied by Splunk. The configured value must be a base URL without a collector or health path; EmDash adds that path itself.
  • Acknowledgements appear wrong: verify the HEC indexer-acknowledgement setting and the EmDash checkbox; it must be enabled as a boolean on both sides.
  • Destination cannot be enabled: save a token and complete a successful connection test first.
  • Events are delayed: check last delivery, pending/retry counts, and provider response status. A delay does not imply that historical events will be replayed.

For help, open support and provide the sanitized destination status, timestamp, and error code only.

See Splunk’s HEC endpoint setup and input endpoint health codes for provider-side details.