> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cantina.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Splunk

> Connect Splunk to Clarion so agents can forward an alert's details and original payload to your Splunk HTTP Event Collector (HEC) during triage.

This guide walks you through connecting Splunk to Clarion using the **HTTP Event Collector (HEC)**. Once connected, Clarion agents can forward the alert they are triaging - its details plus the original payload Clarion ingested - to Splunk as an event, so your alerts and investigations land in your SIEM alongside the rest of your data.

> **Note:** **Estimated time:** 5 minutes. You will need access to **Splunk → Settings → Data Inputs → HTTP Event Collector** and the ability to create a token.

## Prerequisites

* A **Splunk** deployment (Splunk Cloud or Splunk Enterprise) with the **HTTP Event Collector** enabled
* Permission to create an **HEC token**
* Your **HEC endpoint URL**, including the port (Splunk Cloud and most self-hosted deployments use `8088`)
* The HEC endpoint must be reachable from Clarion's servers
* A **Clarion workspace** with the Splunk integration page open

***

## Step 1 - Create an HEC token in Splunk

1. Sign in to **Splunk**.
2. Go to **Settings → Data Inputs → HTTP Event Collector**.
3. Confirm the collector is enabled under **Global Settings** (toggle **All Tokens** to **Enabled**). Note the **HTTP Port Number** (default `8088`).
4. Click **New Token**.
5. Give the token a name (for example, `Clarion Integration`) and complete the wizard. You can optionally set a default **index**, **source**, and **sourcetype**.
6. Copy the generated **token value**.

> **Warning:** Treat the HEC token like a password. Anyone with the token and endpoint can send events into your Splunk indexes.

***

## Step 2 - Find your HEC URL

The HEC endpoint depends on your Splunk deployment. Your stack's **web URL is not** the HEC endpoint.

| Deployment                        | HEC URL                                       | Port          |
| --------------------------------- | --------------------------------------------- | ------------- |
| **Splunk Cloud (production)**     | `https://http-inputs-<stack>.splunkcloud.com` | 443 (default) |
| **Splunk Cloud on GCP/Azure**     | `https://http-inputs.<stack>.splunkcloud.com` | 443 (default) |
| **Splunk Cloud free trial**       | `https://<stack>.splunkcloud.com`             | 8088          |
| **Self-hosted Splunk Enterprise** | `https://<your-splunk-host>`                  | 8088          |

`<stack>` is the identifier in your Splunk Cloud URL (e.g. `prd-p-abc12` in `prd-p-abc12.splunkcloud.com`). Note the required `http-inputs-` prefix for production Cloud stacks.

> **Note:** Splunk Cloud **free-trial** stacks (and many on-prem deployments) present a **self-signed certificate**. For those, enable **Allow self-signed certificate** on the configuration form (see Step 3). Production Cloud stacks have valid certificates - leave it off.

## Step 3 - Enter credentials in Clarion

1. In Clarion, open **Integrations** and find **Splunk** under **Security & Monitoring**.
2. Enter your **HEC URL** from the table above. The `https://` scheme is optional (Clarion adds it), and you don't need the `/services/collector` path - Clarion appends it. Include `:8088` only for trial/self-hosted stacks.
3. Paste the **HEC token** from Step 1.
4. Optionally set a default **index**, **source**, and **sourcetype**. Leave these blank to use the defaults configured on the token.
5. If your stack serves a self-signed cert (trial / on-prem), enable **Allow self-signed certificate**.
6. Click **Connect**.

Clarion validates the endpoint and token by sending a single test event before saving. If the endpoint is unreachable or the token is rejected, you'll see a clear error and nothing is persisted.

***

## Step 4 - Verify events reached Splunk

Because **Connect** sends one test event, you can confirm data is landing right away.

1. In Splunk, open **Search & Reporting**.
2. Search the last 15 minutes for the test event:
   ```javascript theme={null}
   index=* "Clarion Splunk HEC connection test"
   ```
   If you set a default **index** on the integration, scope to it (e.g. `index=security ...`). Otherwise events land in the index bound to your HEC token - use `index=*` if you're unsure which.
3. One matching event (with `forwarded_by=clarion`) confirms the endpoint, token, and index are all working.

To verify **agent-forwarded alerts** later, search for the events Clarion sends during triage:

```javascript theme={null}
index=* forwarded_by=clarion
```

Each event is JSON, so Splunk auto-extracts fields you can filter and report on:

| Field                | Example                                    | Meaning                                |
| -------------------- | ------------------------------------------ | -------------------------------------- |
| `forwarded_by`       | `clarion`                                  | Marks events Clarion sent              |
| `subject_kind`       | `alert` / `issue`                          | What was forwarded                     |
| `subject.reference`  | `ALR-1423`                                 | Clarion alert/issue reference          |
| `subject.severity`   | `high`                                     | Severity at forward time               |
| `subject.url`        | `https://app.clarion.com/<ws>/alerts/1423` | Link back to Clarion                   |
| `triage_summary`     | `Confirmed benign…`                        | The agent's note, when provided        |
| `original_payload.*` | -                                          | The untouched payload Clarion ingested |

To find one specific alert, search by its reference - for example `index=* "ALR-1423"`. If you set a **sourcetype** (e.g. `clarion:alert`), `sourcetype="clarion:alert"` also scopes to Clarion's events.

***

## What agents can do

Once connected, agents on this workspace gain access to the `/splunk` action. When an agent uses it during triage, Clarion forwards a single event to your HEC endpoint containing:

* **Alert details** - number, title, description, severity, status, source, disposition, and a link back to the alert in Clarion
* **The original payload** - the untouched event Clarion ingested for the alert
* **The agent's triage summary** - an optional note the agent attaches describing its findings

The agent can override the destination **index**, **source**, or **sourcetype** per event; otherwise the defaults you configured are used. The event is sent to your collector's `/services/collector/event` endpoint.

To make an agent forward alerts, add the **Splunk** action to a skill the agent runs (for example, a skill that forwards every confirmed incident to your SIEM).

***

## Disconnect

To remove the integration:

1. In Clarion, open **Integrations → Splunk**.
2. Click **Disconnect**.

This deletes the stored HEC URL and token. Agents on this workspace will no longer see the `/splunk` action, and any saved skills that reference it will surface the integration as missing until you reconnect.

***

## Troubleshooting

### "Splunk rejected the HEC token"

The token is disabled or incorrect. In **Settings → Data Inputs → HTTP Event Collector**, confirm the token is **Enabled**, that **All Tokens** is enabled under **Global Settings**, and that you copied the full token value.

### "Splunk returned 404 - that URL isn't an HEC collector"

You're pointing at the wrong host - most often the stack's **web UI** instead of HEC. Use the HEC URL from the table in Step 2 (for production Splunk Cloud, the `https://http-inputs-<stack>.splunkcloud.com` form), and confirm HEC is enabled (**Global Settings → All Tokens → Enabled**). Clarion appends `/services/collector/event`, so enter only the base URL.

### "Self-signed certificate" / TLS errors

Your stack presents a certificate Clarion doesn't trust - common on Splunk Cloud **free-trial** stacks and on-prem deployments. Enable **Allow self-signed certificate** on the configuration form. Leave it off for production Cloud stacks (which have valid certificates).

### "Failed to reach the Splunk HEC endpoint"

The endpoint isn't reachable from Clarion's servers. If your collector is on a private network, expose it (or its HEC port) so Clarion can deliver events, then reconnect.