Integrate Splunk Cloud Platform Monitoring
Overview
You can configure an HTTP Event Collector (HEC) integration to send file transfer activities and device status changes to Splunk Cloud Platform for monitoring.
Once configured, whenever a selected event occurs—such as Transfer Started, Transfer Completed, Device Connected, or Device Disconnected—the event is automatically sent to Splunk for monitoring.
The overall process consists of the following steps:
① Generate an HEC Token and Verify the HEC URL → ② Configure the Integration in the Product
Prerequisites
Before you begin, verify the following requirements.
| Item | Description |
|---|---|
| Splunk Cloud Account | A Splunk Cloud Platform account with permission to create HEC Tokens. |
| Target Index | An index where events will be stored must already exist. |
| Network | The environment where the product is installed must be able to access the HEC endpoint (http-inputs-<stack>.splunkcloud.com) over HTTPS (443). |
Generate an HEC Token and Verify the HEC URL
Splunk Cloud Platform receives events through the HTTP Event Collector (HEC).
To send events, you need an HEC Token and the HEC URL.
Step 1. Generate an HEC Token
In Splunk Web, navigate to Settings → Data Inputs → HTTP Event Collector → New Token.
Alternatively, select Settings → Add Data → Monitor → HTTP Event Collector.
Enter a token name, select the Source Type and the target Index, then generate the token.
Copy the generated token and verify that its status is Enabled.
Treat the HEC Token like a password. Do not expose it in public repositories or external documentation.
If the token is compromised, disable or delete it and generate a new one.
Step 2. Verify the HEC URL
Verify the HEC URL for your Splunk Cloud Platform environment.
Example:
The event collection endpoint is:
and uses HTTPS (443).
Verification
✔ The HEC Token has been generated.
✔ The HEC Token is enabled.
✔ The HEC URL has been verified.
Configure the Splunk Cloud Platform Integration
Enter the HEC URL and HEC Token into the product.
When you open the Monitoring configuration page, the following screen is displayed.
Step 1. Enter the Splunk HEC URL
Enter the HEC URL.
Example:
Step 2. Enter the HEC Token
Enter the generated HEC Token.
Step 3. Select Events
Select the events to monitor.
Multiple events can be selected. Only the selected events will be sent to Splunk.
| Event | Trigger |
|---|---|
| Transfer Started | When a Transfer begins. |
| Transfer Completed | When a Transfer completes successfully. |
| Transfer Paused | When a Transfer is paused. |
| Transfer Recovered | When a Transfer automatically resumes after an interruption or failure. |
| Device Connected | When a device connects. |
| Device Disconnected | When a device disconnects. |
Step 4. Save the Configuration
After completing the configuration, click Add to save the integration.
Verification
✔ The Splunk HEC URL has been entered.
✔ The HEC Token has been entered.
✔ The monitoring events have been selected.
Verify the Integration
Verify that the integration is operating correctly.
Step 1. Generate a Test Event
Start a Transfer or trigger one of the selected monitoring events.
Step 2. Verify in Splunk
Search the target index in Splunk to verify that the event has been collected.
Example:
Verification
✔ The event has been collected in Splunk.
✔ The generated event has been delivered successfully.
Configuration Complete
After the configuration is saved, the integration becomes active.
From this point forward, whenever one of the selected events occurs, the corresponding event is automatically sent to Splunk.
Troubleshooting
| Issue | Verification |
|---|---|
| Events are not collected | Verify that the Splunk HEC URL and HEC Token are correct and contain no leading or trailing spaces. |
| HEC Token does not work | Verify that the token is Enabled and that deployment has completed. |
| Authentication error | Verify that the HEC Token is valid. |
| Index error | Verify that the index assigned to the HEC Token exists. |
| Connection failure | Verify that access to the HEC endpoint (http-inputs-<stack>.splunkcloud.com, HTTPS 443) is allowed by the firewall or proxy. |