# Splunk HEC setup

P0 integrates with Splunk HEC (HTTP Event Collector) to forward audit logs from your P0 tenant to your Splunk instance.

## Prerequisites

* Existing P0 account at [p0.app](https://p0.app/)
* Splunk Instance Admin Role
* Public-facing Splunk instance with HEC endpoint secured by an SSL certificate.
  * The SSL certificate must be signed by a trusted Certificate Authority (CA) to ensure secure communication. Self-signed certificates are not allowed by P0 Security.
* Splunk HEC Token

## Set up Splunk HEC token

{% hint style="info" %}
This setup takes about 5 minutes.
{% endhint %}

1. Log in to [p0.app](https://p0.app) and select **Integrations**. Under **Security Information & Event Managers**, select **Splunk**, then select the **HTTP Event Collector** component:

   <figure><img src="/files/KQURNMZMx8SfgAQL01GK" alt="P0 Integrations page with Splunk selected, showing the HTTP Event Collector component"><figcaption></figcaption></figure>
2. Click on "Add Token" to install.

   <figure><img src="/files/3z48B8oiivPpi6nGzQBM" alt="P0 Splunk HTTP Event Collector page showing the installed tokens table and the Add token button highlighted"><figcaption></figcaption></figure>
3. Enter a unique custom identifier for the token and click "Next":

<div align="center" data-full-width="true"><figure><img src="/files/qbBnYe5BPpaBRbhSdBVk" alt="Splunk HEC token installation form with the token identifier input field highlighted" width="563"><figcaption></figcaption></figure></div>

4. Enter the desired configuration and click "Finish" to complete the installation. See the [configuration section](#configuring-splunk-hec-token) for information about the settings.

   <figure><img src="/files/vtxt661Ow9wS9IsiMLCa" alt="Splunk HEC configuration form with HEC endpoint and HEC token input fields and the Finish button"><figcaption></figcaption></figure>

## Configuring Splunk HEC token

### Endpoint

HTTPS endpoint with valid SSL certificate. The instance port number required to form the URL can be found in the "Global Settings" within the HEC Settings page.

{% hint style="info" %}
example: <https://hec.example.com:8088/>
{% endhint %}

### Token

Tokens are 32 character GUIDs that let logging agents and HTTP clients connect to the HEC input.

{% hint style="info" %}
Refer to the official Splunk documentation for detailed instructions: [Set up HTTP Event Collector](https://docs.splunk.com/Documentation/Splunk/9.4.0/Data/UsetheHTTPEventCollector).
{% endhint %}

{% hint style="success" %}
Congratulations! You are now set up with Splunk audit logs integration.
{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.p0.dev/integrations/siem-integrations/splunk-hec-setup.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.