---
url: https://docs.realmsec.info/integration/splunk.md
---

# Splunk Integration

Realm integrates with Splunk by forwarding processed security events to a Splunk HTTP Event Collector (HEC) endpoint. This allows you to use Realm as part of your existing Splunk workflow — enriching, normalizing, and routing logs through Realm before they land in Splunk for search and alerting.

> **Note:** This guide covers using Splunk as a **destination** (Realm → Splunk). To ingest logs from Splunk into Realm, see the [Splunk HEC Source guide](/integration/splunk-hec).

## 1. Configure an HTTP Event Collector in Splunk

1. Login to the Splunk Console
2. Go to **Settings > Data Inputs**

![Splunk data inputs](../images/splnk-1-data-inputs.png)

3. Select **HTTP Event Collector**

![Splunk http event collector](../images/splnk-2-http-event-collector.png)

4. Click on **New Token**

![Splunk new token](../images/splnk-3-new-token.png)

5. Enter a name for the token:

> `Realm.Security`

![Splunk Config token form](../images/splnk-4-config-token-form.png)

6. Select an index to save data to or **Create New Index**

![Splunk Select index](../images/splnk-5-select-index.png)

7. Click **Review**

![Splunk Review add data form](../images/splnk-6-review-form.png)

8. Click **Submit**
9. Copy the token value and save it securely — you'll need it in the next section

![Splunk Token value](../images/splnk-7-token-value.png)

🔗 **Helpful Links**

* [Splunk Enterprise HEC Setup Docs](https://help.splunk.com/en/splunk-enterprise/get-data-in/collect-http-event-data/set-up-and-use-http-event-collector-in-splunk-web)
* [Splunk Cloud HEC Setup Docs](https://help.splunk.com/en/splunk-cloud-platform/get-started/get-data-in/9.3.2411/get-data-with-http-event-collector/set-up-and-use-http-event-collector-in-splunk-web)

***

## 2. Configure an Output Feed in Realm

1. Create a **Destination** for Splunk:
   * Use the **Endpoint** and **Token** obtained in the previous section

2. Add a new **Output Feed**:
   * Set the **Name** (e.g., `Splunk Output`)
   * Optionally add a **Description**
   * Select **Splunk** as the method
   * Enter the **Endpoint**

     Example:

     ```text
     https://http-inputs-<host>.splunkcloud.com
     ```

> **Note for Splunk Cloud Users**\
> When configuring an Output Feed for **Splunk Cloud**, ensure your HEC endpoint follows this format:\
> `https://http-inputs-<host>.splunkcloud.com`
>
> Failing to specify `https` can result in data being sent in an unexpected or unsupported format.
>
> [View Splunk’s official guidance](https://help.splunk.com/en/splunk-cloud-platform/get-started/get-data-in/9.3.2411/get-data-with-http-event-collector/set-up-and-use-http-event-collector-in-splunk-web#send-data-to-http-event-collector-on-splunk-cloud-platform-0)

3. Paste the **Token** from the previous step
4. Choose the **Format** — we recommend starting with `JSON` or RAW unless otherwise specified

## Troubleshooting

If data is not flowing through to Splunk

* check if the Splunk token has permission to write to the configured index
* check if there are any IP restrictions on Splunk ingestion ensure Realm IP range is allowed. Please contact Realm support to get a fixed IP range that can be whitelisted.

***

## Export Detections for Detection Integrity

[Detection Integrity](/product/detection_integrity) checks your log optimization rules against your Splunk detections, so optimizations never drop data a detection depends on. Export your detections as described below, then upload them to Realm.

Export all relevant detections using following options:

### Option 1: Export content from Splunk Enterprise Security as an app

See [Splunk Enterprise Security - Administer - Managing security cotent](https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.7/managing-security-content/export-content-from-splunk-enterprise-security-as-an-app)

1. From Splunk Enterprise Security menu bar, select Security content then Content management.
2. Select the check boxes of the detections (saved searches) you want to export.
3. Select Edit Selection and select Export.
4. Type an App name. This will be the name of the app file. For example, ***splunkES_detections_to_realm_date***.
5. Select No Prefix.
6. Type a Label. This reflects the name of the app. For example, ***ES Detections to Realm***.
7. Select Export.
8. Select Download app now to download the app package to the search head at the location $SPLUNK_HOME/etc/apps/SA-Utils/local/data/appmaker/\*. "Download app now" generates a compressed file and caches it directly inside the SA-Utils directory on your search head.

### Option 2: Export scheduled searches using Splunk `rest` command

1. Using Splunk Search: run the `rest` searches, ensure to include all apps with enabled detections within search parameter.

**SPL to get all scheduled saved searches from related apps**

```
| rest "/servicesNS/-/-/saved/searches"  
| search NOT search="| noop"  
| eval Type="Saved Searches/Alerts/Reports"  
| search eai:acl.app IN(SplunkEnterpriseSecuritySuite, <INCLUDE_ALL_APPS_WITH_DETECTIONS>) 
| search is_scheduled = 1  
| table Type title eai:acl.app search
```

**SPL to get enabled finding-based searches**

```
| rest /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches 
| where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]")
| where disabled=0
| eval Type="Correlation Searches"  
| table Type title search
```

**SPL to get macro definitions**

```
| rest /servicesNS/-/-/admin/macros 
| search eai:acl.app IN(SplunkEnterpriseSecuritySuite, <INCLUDE_ALL_APPS_WITH_DETECTIONS>)  
| table title, definition eai:acl.app 
| rename title as macro
```

2. Once search job has completed, click ***Export***.

![alt text](../images/splunk-export-image.png)

3. Select CSV as format
4. Click ***Export***.

![alt text](../images/splunk-export-popup.png)

### Upload the Export to Realm

Upload the exported file as described in [Upload Detections to Realm](/product/detection_integrity#upload-detections), selecting your Splunk destination.

## Support

For additional details, refer to the official Splunk documentations:

[Splunk export search results](https://help.splunk.com/en/splunk-enterprise/search/search-manual/9.4/export-search-results/export-search-results)

[Splunk Finding-based Detections](https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.5/detections/finding-based-detections-available-in-splunk-enterprise-security)

[Splunk `rest` command](https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.6/search-commands/rest)

If you encounter any issues or require assistance, contact Realm Security support.