Set up alerting - Splunk

You can integrate with Splunk to subscribe events you wish to monitor.

Prerequisites

• Splunk integration token

Create a Splunk Connection

1. Select Settings from the side navigation. Under the Integration menu, click Splunk.

2. Click the + Connection button.

3. Enter a unique name for the connection.

4. Generate an integration token following the Splunk docs

5. Copy your integration token and paste it into the token field.

6. Enter the port number (default is 8088).

7. If you are testing with a free trial, select the Free Trial check-box.

8. Enter the base URL of your Splunk account.

9. Click Test & Save.

Create a Splunk subscription

1. Click the + Subscription button to begin the creation process.

2. Choose a name for the subscription as well as the saved filters you would like the subscription to be based on.

3. Choose the connection for the subscription output.

4. Enter the Splunk index.

5. Enter a Splunk source type.

6. Click Test & Save

Vault Radar events matching your filters will create events in the specified Splunk index.