> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Splunk (SIEM)

*This article covers the **Splunk SIEM logging** connection, which streams Lumos events into a Splunk HTTP Event Collector. To sync Splunk users and roles for visibility and Access Reviews instead, see [Connecting Splunk](/kb/integrations-3/other_integrations-1/connecting-splunk). The two connections authenticate differently and can be used independently.*

## After this article

You'll be able to connect Splunk to Lumos for SIEM logging and resolve the common issues that come up during setup.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| SIEM event logging | Logging | Yes | No | Events that happen in Lumos post to the configured Splunk HTTP Event Collector. |

Lumos transmits events through the `services/collector/event` endpoint. For the event logging format and the types of events sent, see the "How Lumos Logs to Your SIEM" article.

## Required plan and roles

There's no minimum Splunk plan required to connect this integration.

Your Splunk user's role needs permission to create an Event Collector token.

## Instructions

**Phase 1: Prepare Splunk**

1. Follow Splunk's instructions to create a new HTTP Event Collector. Set the name to **Lumos**. Copy the token value Splunk gives you so you can add it to Lumos.
2. Get the host name from your Splunk URL. The host name is the subdomain shown when you log into Splunk. For example, if your Splunk URL is `https://prod1920.splunkcloud.com/`, your host value is `prod1920`.

**Phase 2: Connect in Lumos**

1. Find the Splunk card in your Lumos integrations (reconnect an existing card or add a new one).
2. Enter your **Host** from Splunk in the **Host** field.
3. Enter your Splunk token in the **Token** field.
4. Click **Connect Splunk** to connect the integration.
5. To enable SIEM logging on this connection, go to your **SIEM settings** and select **Splunk** from the dropdown.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Connection fails or the setup buffers and returns a 404.** Confirm the **Host** field holds the correct Splunk value rather than the HTTP Event Collector ingest endpoint. For the SIEM logging connection, use the Event Collector host and token created in Phase 1. If you're connecting the separate user and role sync app instead, that one expects the Splunk Cloud REST or management hostname (for example `prd-p-xxxxx.splunkcloud.com`) on port 8089, not the HEC endpoint, and needs the Lumos IPs allowlisted.