# Splunk (Legacy)

## Learn more about Sentry's Splunk integration, which allows you to send Sentry events to Splunk.

Splunk integration is deprecated and is not availble to be installed on new projects.

Connect Splunk to Sentry with the [Data Forwarding](/concepts/data-management/data-forwarding/) feature.

We only support Splunk Cloud plans. We do not support Splunk Enterprise plans. See the [Splunk documentation](https://dev.splunk.com/) for specific details on your Splunk installation.

This integration needs to be set up in each project for which you wish to use it. It is maintained and supported by the [Sentry community](https://open.sentry.io/).

## [Install and Configure](#install-and-configure)

Sentry owner, manager, or admin permissions are required to install this integration.

Navigate to **Settings > Integrations > Splunk**

[![Install Splunk integration](/_next/image/?url=%2Fmdx-images%2Fsplunk-XWOOBLZK.png%231500x587\&w=3840\&q=75)](/mdx-images/splunk-XWOOBLZK.png)

### [Enabling HEC](#enabling-hec)

To get started, you’ll need to first enable the HTTP Event Collector:

Under **Settings**, select **Data Inputs**:

[![Splunk settings](/_next/image/?url=%2Fmdx-images%2Fsplunk-settings-JBRG4DPD.png%23665x435\&w=1920\&q=75)](/mdx-images/splunk-settings-JBRG4DPD.png)

Select **HTTP Event Collector** under Local Inputs:

[![Splunk data inputs](/_next/image/?url=%2Fmdx-images%2Fsplunk-data-inputs-IZVOC7Z7.png%231264x482\&w=3840\&q=75)](/mdx-images/splunk-data-inputs-IZVOC7Z7.png)

Under your HEC settings, click "Global Settings":

[![Splunk HEC inputs](/_next/image/?url=%2Fmdx-images%2Fsplunk-hec-inputs-F5TUPULI.png%231277x271\&w=3840\&q=75)](/mdx-images/splunk-hec-inputs-F5TUPULI.png)

Change **All Tokens** to **Enabled**, and note the HTTP Port Number (`8088` by default):

[![Splunk global settings](/_next/image/?url=%2Fmdx-images%2Fsplunk-hec-global-settings-RF3ZVZNE.png%23817x494\&w=1920\&q=75)](/mdx-images/splunk-hec-global-settings-RF3ZVZNE.png)

If you’re running Splunk in a privileged environment, you may need to expose the HEC port.

### [Creating a Sentry Input](#creating-a-sentry-input)

Under HTTP Event Collector, create a new Sentry input by clicking "New Token":

[![Splunk Sentry input](/_next/image/?url=%2Fmdx-images%2Fsplunk-new-http-input-YAHEUMFD.png%231278x284\&w=3840\&q=75)](/mdx-images/splunk-new-http-input-YAHEUMFD.png)

Enter a name (e.g. `Sentry`), and click "Next":

[![Input a name in Splunk](/_next/image/?url=%2Fmdx-images%2Fsplunk-new-input-name-N4HJEILM.png%231278x591\&w=3840\&q=75)](/mdx-images/splunk-new-input-name-N4HJEILM.png)

Select the index you wish to make accessible (e.g. `main`), and click "Review":

[![Select index in Splunk](/_next/image/?url=%2Fmdx-images%2Fsplunk-new-input-index-4DTL3XYZ.png%231277x733\&w=3840\&q=75)](/mdx-images/splunk-new-input-index-4DTL3XYZ.png)

You’ll be prompted to review the input details. Click "Submit" to continue:

[![Review form before submitting](/_next/image/?url=%2Fmdx-images%2Fsplunk-new-input-review-YBJTAGE5.png%23624x558\&w=1920\&q=75)](/mdx-images/splunk-new-input-review-YBJTAGE5.png)

The input has now been created, and you should be presented with the **Token Value**:

[![Token has been successfully created in Splunk](/_next/image/?url=%2Fmdx-images%2Fsplunk-new-input-final-6NBA6QX5.png%23983x539\&w=2048\&q=75)](/mdx-images/splunk-new-input-final-6NBA6QX5.png)

### [Enabling Splunk Forwarding](#enabling-splunk-forwarding)

To enable Splunk forwarding, you’ll need the following:

* Your instance URL (see note below)
* The Sentry HEC token value

In Sentry, navigate to the project you want to forward events from, and click "Project Settings".

### [Data Forwarding](#data-forwarding)

Configure [data forwarding](/concepts/data-management/data-forwarding/) in **\[Project] > Settings > Data Forwarding**, and provide the required information for the given integration.

After navigating to **Data Forwarding**, enable the Splunk integration:

[![Data forwarding settings page](/_next/image/?url=%2Fmdx-images%2Fsplunk-data-forwarding-setting-VR4WBNMA.png%231098x768\&w=3840\&q=75)](/mdx-images/splunk-data-forwarding-setting-VR4WBNMA.png)

Your instance URL is going to vary based on the type of Splunk service you’re using. If you’re using self-service Splunk Cloud, the instance URL will be the URL of the Splunk instance running the HTTP Event Collector (HEC):

```bash
https://<host>:8088
```

For all other Splunk Cloud plans, you’ll use the `http-inputs` prefix:

```bash
https://http-inputs-<host>:8088
```

If you’re using Splunk behind your firewall, you’ll need to fill in the appropriate host.

Once you’ve filled in the required fields, hit **Save Changes**:

[![Splunk settings form](/_next/image/?url=%2Fmdx-images%2Fsplunk-data-forwarding-setting-complete-T7V3YYPZ.png%23809x512\&w=1920\&q=75)](/mdx-images/splunk-data-forwarding-setting-complete-T7V3YYPZ.png)

We’ll now begin forwarding all new events into your Splunk instance.

Sentry will internally limit the maximum number of events sent to your Splunk instance to 1000 per second.

[![Splunk page showing Sentry data](/_next/image/?url=%2Fmdx-images%2Fsplunk-search-sentry-NJ24G5ZF.png%231099x848\&w=3840\&q=75)](/mdx-images/splunk-search-sentry-NJ24G5ZF.png)
