> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/integrations/siem-integrations/splunk-hec-setup.md).

# Splunk HEC setup

P0 integrates with Splunk HEC (HTTP Event Collector) to forward audit logs from your P0 tenant to your Splunk instance.

## Prerequisites

* Existing P0 account at [p0.app](https://p0.app/)
* Splunk Instance Admin Role
* Public-facing Splunk instance with HEC endpoint secured by an SSL certificate.
  * The SSL certificate must be signed by a trusted Certificate Authority (CA) to ensure secure communication. Self-signed certificates are not allowed by P0 Security.
* Splunk HEC Token

## Set up Splunk HEC token

{% hint style="info" %}
This setup takes about 5 minutes.
{% endhint %}

1. Log in to [p0.app](https://p0.app) and select **Integrations**. Under **Security Information & Event Managers**, select **Splunk**, then select the **HTTP Event Collector** component:

   <figure><img src="/files/KQURNMZMx8SfgAQL01GK" alt="P0 Integrations page with Splunk selected, showing the HTTP Event Collector component"><figcaption></figcaption></figure>
2. Click on "Add Token" to install.

   <figure><img src="/files/3z48B8oiivPpi6nGzQBM" alt="P0 Splunk HTTP Event Collector page showing the installed tokens table and the Add token button highlighted"><figcaption></figcaption></figure>
3. Enter a unique custom identifier for the token and click "Next":

<div align="center" data-full-width="true"><figure><img src="/files/qbBnYe5BPpaBRbhSdBVk" alt="Splunk HEC token installation form with the token identifier input field highlighted" width="563"><figcaption></figcaption></figure></div>

4. Enter the desired configuration and click "Finish" to complete the installation. See the [configuration section](#configuring-splunk-hec-token) for information about the settings.

   <figure><img src="/files/vtxt661Ow9wS9IsiMLCa" alt="Splunk HEC configuration form with HEC endpoint and HEC token input fields and the Finish button"><figcaption></figcaption></figure>

## Configuring Splunk HEC token

### Endpoint

HTTPS endpoint with valid SSL certificate. The instance port number required to form the URL can be found in the "Global Settings" within the HEC Settings page.

{% hint style="info" %}
example: <https://hec.example.com:8088/>
{% endhint %}

### Token

Tokens are 32 character GUIDs that let logging agents and HTTP clients connect to the HEC input.

{% hint style="info" %}
Refer to the official Splunk documentation for detailed instructions: [Set up HTTP Event Collector](https://docs.splunk.com/Documentation/Splunk/9.4.0/Data/UsetheHTTPEventCollector).
{% endhint %}

{% hint style="success" %}
Congratulations! You are now set up with Splunk audit logs integration.
{% endhint %}