> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/system-management/settings/connectors/siem-and-soar-connectors/splunk.md). # Splunk You can send these DoControl entities to your organization's consolidated event management system for further investigation, data aggregation, and monitoring: * **Alerts** - Investigate alerts in Splunk and remediate in the DoControl platform when necessary. * **Workflows** - A JSON structured log is sent to Splunk, containing a synthetic high-level summary of each workflow execution. The log includes the workflow name, actor, event type, app, execution duration, and execution path. * **SaaS events** - Select the relevant app and event types to send to Splunk. {% hint style="warning" %} * Sending events and workflows to your SIEM increases the volume of generated logs and might impact your SIEM cost. * DoControl sends logs for event-triggered workflows only, not for on-demand, scheduled, or alert-triggered workflows. {% endhint %} To push DoControl data downstream to the Splunk alert and event pipeline and display them in the collection board, you need to: 1. [Generate a Splunk instance URL ](#generate-splunk-instance-url) 2. [Generate an HTTP event connector token](#generate-http-event-connector-token-in-splunk) 3. [Connect to Splunk SIEM in DoControl ](#connect-to-splunk-siem-in-docontrol) ## Generate Splunk instance URL 1. Login to your Splunk account. 2. In the top menu, select **Settings > Data > Data inputs**.
3. In the Data inputs page, click **HTTP Event Collector > Global settings**. 4. **Optional**: In the Edit Global settings popup, copy the **HTTP port number** and close the popup.\ Note: The port number is optional, and not mandatory for setting up the connection.
5. Copy the Splunk website URL in the following format:\ `https://<>.splunkcloud.com:HTTP-Port-Number` \ **Note**: The port number is optional, but not mandatory for setting up the connection. 6. Paste it somewhere to keep for the next step: [Generate HTTP event connector token in Splunk](#generate-http-event-connector-token-in-splunk). ## Generate HTTP event connector token in Splunk 1. In the top menu, select **Settings > Data > Data inputs.** 2. In the Data inputs page, click **HTTP Event Collector > Add new**. 3. Under Select Source, give this source a proper name (DoControl). 4. Leave the **Enable indexer acknowledgement** checkbox unchecked. 5. Click **Next**.
6. Under Input Settings > Source type, select **Automatic** and click **Review > Submit**.
7. Paste the event connector token somewhere to keep for the next step: [Connect to Splunk SIEM in DoControl.](#connect-to-splunk-siem-in-docontrol) ## Connect to Splunk SIEM in DoControl Make sure you generated both the [Splunk instance URL](#generate-splunk-instance-url) and the [HTTP event connector ](#generate-http-event-connector-token-in-splunk)in Splunk before you perform the one-time SIEM connection in DoControl. 1. In DoControl, click **Settings** from the top-right corner in any screen. 2. Navigate to **Connectors > SIEM and SOAR connectors > Splunk**.
3. Enter the **Splunk instance URL** and **HTTP event connector token** that you generated in the previous steps. 4. **Optional**: Enter custom header keys and values. HTTP headers can provide attribution information on the data being sent to the SIEM. 5. Click **Add** to enter additional header keys and values. 6. Select the DoControl data types to send to Splunk: * Alerts * SaaS events * Workflows
7. For SaaS events, select the relevant **app** and **event types**. 8. For **workflows**, select the relevant workflows and execution status.\ You can select between 1 and 100 event-triggered workflows. 1. To send all your workflows to Splunk, click **Select all**. 2. Select the relevant execution status: Completed, Warning, Failed, Cancelled or Timed out.
9. Click **Add app** to send events from another integrated app. 10. Click **Test & Save**. 11. If you wish to edit the connector, make any changes and click **Test & Save**.

Once you're connected to Splunk, you'll receive a success message as confirmation:

Success!

Your Splunk connector is all set up. DoControl data logs are now being pushed downstream to Splunk.

## Delete a connector If you wish to delete the connector, you can no longer view DoControl alerts, workflows or events in Splunk. 1. From the top-right corner in DoControl, navigate to **Settings > Connectors > SIEM and SOAR connectors > Splunk**. 2. Click **Disable** in the top-right. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/system-management/settings/connectors/siem-and-soar-connectors/splunk.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.