Splunk Setup Guide

Follow our setup guide to integrate Fivetran logs into your Splunk monitoring system.

Prerequisiteslink

To connect Splunk to Fivetran, you need:

• A Splunk account
• edit_token_http permissions to enable HTTP Event Collector (HEC)

We support HEC on Splunk Enterprise platforms and Splunk Cloud deployments.

In Splunklink

Enable HTTP Event Collectorlink

Set up your HTTP Event Collector to configure a secret token that Fivetran can use to send data using HTTP and HTTPS.

1. Click Settings > Data Inputs.

2. Click HTTP Event Collector.

3. Click Global Settings.

4. Set the All Tokens toggle to Enabled.

   

5. (Optional) Select a Default Source Type for all HEC tokens.

6. (Optional) Select a Default Index.

7. (Optional) Select a Default Output Group.

8. (Optional) Check the Use Deployment Server checkbox to use a deployment server to handle configurations for HEC tokens.

9. (Optional) Check the Enable SSL checkbox to have HEC listen and communicate over HTTPS rather than HTTP.

10. (Optional) Enter a number in the HTTP Port Number field for HEC to listen on.

    Tip: Confirm that your firewall rules don’t block incoming and outgoing traffic through the port number.

11. Click Save.

Create an Event Collector Tokenlink

You must configure one token to use HEC.

1. Click Settings > Add Data.
2. Click monitor.
3. Click HTTP Event Collector.
4. Enter a name for the token in the Name field. For example, Fivetran Logs.
5. (Optional) In the Description field, enter a description for the input and click Next.
6. (Optional) Confirm the source type and the index for HEC events.
7. Click Review.
8. Confirm that all settings are correct for the endpoint.
9. Click Submit.
10. Copy the secret token and store it somewhere secure.

In Fivetranlink

1. Log in to your Fivetran account.

2. In the left hand navigation pane, click Logs.

   

3. Click Connect your logging service.

   

4. Select the Splunk logging service.

5. In the setup form, enter Host and Port details.

6. Set the Enable SSL toggle to Enabled.

7. Enter the secret token that you configured in the Splunk HEC.

8. Click Save & Test. Fivetran will take it from here and sync your logs to Splunk.