Skip to main content
This article covers the Splunk SIEM logging connection, which streams Lumos events into a Splunk HTTP Event Collector. To sync Splunk users and roles for visibility and Access Reviews instead, see Connecting Splunk. The two connections authenticate differently and can be used independently.

​
After this article

You’ll be able to connect Splunk to Lumos for SIEM logging and resolve the common issues that come up during setup.

​
Capabilities

Lumos transmits events through the services/collector/event endpoint. For the event logging format and the types of events sent, see the “How Lumos Logs to Your SIEM” article.

​
Required plan and roles

There’s no minimum Splunk plan required to connect this integration. Your Splunk user’s role needs permission to create an Event Collector token.

​
Instructions

Phase 1: Prepare Splunk
  1. Follow Splunk’s instructions to create a new HTTP Event Collector. Set the name to Lumos. Copy the token value Splunk gives you so you can add it to Lumos.
  2. Get the host name from your Splunk URL. The host name is the subdomain shown when you log into Splunk. For example, if your Splunk URL is https://prod1920.splunkcloud.com/, your host value is prod1920.
Phase 2: Connect in Lumos
  1. Find the Splunk card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Enter your Host from Splunk in the Host field.
  3. Enter your Splunk token in the Token field.
  4. Click Connect Splunk to connect the integration.
  5. To enable SIEM logging on this connection, go to your SIEM settings and select Splunk from the dropdown.

​
API Endpoints Used

​
Troubleshooting

Connection fails or the setup buffers and returns a 404. Confirm the Host field holds the correct Splunk value rather than the HTTP Event Collector ingest endpoint. For the SIEM logging connection, use the Event Collector host and token created in Phase 1. If you’re connecting the separate user and role sync app instead, that one expects the Splunk Cloud REST or management hostname (for example prd-p-xxxxx.splunkcloud.com) on port 8089, not the HEC endpoint, and needs the Lumos IPs allowlisted.