What this connection does

Splunk HEC is an outbound destination for tenant-scoped audit events. EmDash sends new events after the destination is activated, in batches where possible, and uses stable event identifiers so retries do not create duplicate logical exports.

Prerequisites

  • A user with integrations:manage to save, test, enable, pause, resume, disable, or rotate the destination. integrations:read can view configuration status and delivery health.
  • A Splunk administrator who can create an HEC token and permit requests from EmDash.
  • An HTTPS HEC endpoint reachable from the public internet. Do not use an HTTP URL, a private address, embedded credentials, or a URL containing a token.
  • The target Splunk index and, if your search conventions require them, a source, sourcetype, and optional host.
  • The HEC token value available for one-time entry in the form. EmDash never displays it again after saving.

Configure Splunk HEC

  1. In Splunk, create or identify an HEC token with permission to write to the intended index. Note the token’s acknowledgement setting if your HEC deployment uses indexer acknowledgements.
  2. In EmDash, open Settings → Integrations and select Splunk HEC.
  3. Enter the HTTPS HEC endpoint. Provide the base HEC URL; EmDash uses the collector endpoint for its connection test.
  4. Enter the Index, and review Source (default emdash) and Sourcetype (default emdash:audit). Add Host only if your Splunk searches require one.
  5. Enter the HEC token. When rotating a token later, re-enter the replacement; the existing secret is write-only.
  6. Enable Indexer acknowledgement only when it is enabled and supported by your HEC deployment. The setting is a boolean and should match Splunk’s configuration.
  7. Select Save, then Test connection. A destination cannot be enabled until a valid secret is configured and the test succeeds.
  8. Select Enable and confirm the page shows enabled state and recent delivery health. Use Pause or Disable when you need to stop new exports.

Delivery and retention

Exports contain redacted audit metadata, not access tokens, message bodies, attachments, or investigation evidence. Delivery starts with events created after activation; there is no automatic historical backfill. Transient HEC failures retry with backoff and eventually appear in delivery health or a dead-letter state for investigation.

Permissions and data boundaries

The HEC token is encrypted and retained server-side. The browser receives only whether a secret is configured, never the token itself. Destination and event access is tenant-scoped, and only users with the integration-management permission can change delivery state.

Troubleshooting

  • Test authentication failed: check the token, HEC token status, index permission, and endpoint URL. Rotate by entering a new token; do not paste it into a support request.
  • Endpoint rejected: use HTTPS and a public HEC endpoint without embedded credentials or private-network addresses.
  • Acknowledgements appear wrong: verify the HEC indexer-acknowledgement setting and the EmDash checkbox; it must be enabled as a boolean on both sides.
  • Destination cannot be enabled: save a token and complete a successful connection test first.
  • Events are delayed: check last delivery, pending/retry counts, and provider response status. A delay does not imply that historical events will be replayed.

For help, open support and provide the sanitized destination status, timestamp, and error code only.