Sending Data to Splunk

You can forward events to Splunk using the HTTP Event Collector (HEC). This guide walks through configuring Dodgeball to send events to Splunk.

1. Create an HEC Token

Create an HEC token in Splunk by following the Splunk documentation.

2. Add Your Splunk HEC Token to Dodgeball

1. Log into Dodgeball and navigate to Developer Center > Checkpoint Secrets.
2. Click Add Secret, enter a name (e.g., splunkHECToken), and paste in your HEC token.
3. Click Save.

3. Add a Custom API Request Block to Your Checkpoint

1. Open a checkpoint and click the Custom tab in the Step Palette.
2. Drag the Custom API Request block onto the canvas and connect it.

4. Configure the Block

Click the Custom API Request block to open the configuration panel and set the required fields to point to your Splunk HEC endpoint, using the secret you saved in step 2.