Splunk destination

(new)

Beta

Data Destinations is currently available as a Private Beta product and the information contained in this document is subject to change. Data Destinations is not a HIPAA Eligible Service or PCI compliant and should not be enabled in workflows that are subject to HIPAA or PCI. To learn more, see Private beta legal information.

Splunk is a platform for searching, monitoring, and analyzing machine-generated data. Send your events to the Splunk HTTP Event Collector (HEC) to make them searchable alongside your existing logs, metrics, and events. Your HEC endpoint must be publicly reachable; self-hosted deployments on a private network aren't supported.

Destination overview

Category: Analytics
Release status: Beta
Authentication: HEC token
Regional availability: US1

Join the Data Destinations private beta

Get early access to native destinations for data warehouses, observability tools, and event pipelines.

Eligible events

You can send all Event Types supported by Event Streams to Splunk. There's no user-identifier restriction for this destination.

Get started

Prerequisites

Before you set up a Splunk destination, make sure you have:

A Splunk deployment with HTTP Event Collector (HEC) turned on. Use Splunk Cloud, or Splunk Enterprise with a publicly reachable HEC endpoint. Self-hosted deployments on a private network aren't supported. On Enterprise, an admin must turn on All Tokens under Settings > Data Inputs > HTTP Event Collector > Global Settings. On Splunk Cloud, HEC is on by default.
An HEC token created in Splunk Web (Settings > Data Inputs > HTTP Event Collector), with an allowed index list that includes the index you want Twilio to write to.
Your HEC base URL, for example https://http-inputs-<host>.splunkcloud.com:443 (Splunk Cloud) or https://<host>:8088 (Splunk Enterprise).

Create the destination

(information)

Info

See Set up a destination for the full UI and Destinations API setup flow common to every destination type.

Twilio Console

To create a Splunk destination in the Twilio Console:

From your Splunk account, gather the settings listed in Destination settings.
In the Twilio Console, go to Data > Data Destinations > Destinations > Add destination subscription.
Complete the Add destination subscription wizard.

Destinations API

To create a Splunk destination through the Destinations API, send a POST request to the Destinations endpoint and set destinationType to splunk. For authentication and the other request body fields, see Create a destination.

Create a destination

POST "https://destinations.twilio.com/v1/ControlPlane/Destinations"

Set the config object in the request body as follows:

Name	Type	Description
`baseUrl` (Required)	string	Your HTTP Event Collector (HEC) base URL, for example `https://http-inputs-HOST.splunkcloud.com:443` (Splunk Cloud) or `https://HOST:8088` (Splunk Enterprise). Twilio appends `/services/collector/event` automatically.
`credentials.credentialType` (Required)	string	Set to `API_KEY`.
`credentials.token` (Required)	string	Your HEC token (a 32-character GUID).
`host`	string	The default `host` value. You can override it for each event.
`index`	string	The default Splunk index for delivered events. The index must already exist in Splunk. You can override it for each event.
`source`	string	The default `source` value. You can override it for each event.
`sourcetype`	string	The default `sourcetype` value. You can override it for each event.

The following example shows a request body. Replace the uppercase placeholder values with your own.

Example request body

1{
2  "destinationType": "splunk",
3  "name": "My Splunk destination",
4  "config": {
5    "baseUrl": "BASE_URL",
6    "credentials": {
7      "credentialType": "API_KEY",
8      "token": "TOKEN"
9    }
10  }
11}

Destination settings

Use splunk as the destinationType.

Field	Description	Required	Default or choices
Base URL	Your HEC base URL, for example `https://http-inputs-<host>.splunkcloud.com:443` (Cloud) or `https://<host>:8088` (Enterprise). Twilio appends `/services/collector/event` automatically.	Yes	None
HEC Token	Your HEC token (a 32-character GUID). Sent as `Authorization: Splunk <token>`. Sensitive: entered once and stored encrypted.	Yes	None
Index	Default Splunk index for delivered events. Must already exist in Splunk. Can be overridden per event through your mapping.	No	None
Sourcetype	Default sourcetype classification. Can be overridden per event through your mapping.	No	None
Source	Default source name. Can be overridden per event through your mapping.	No	None
Host	Default host value. Can be overridden per event through your mapping.	No	None

Twilio authenticates to Splunk by using your HEC Token, sent as an Authorization: Splunk <token> header on every event delivered. The scheme word is Splunk, not Bearer.

Default mappings

Twilio forwards the full event payload as the searchable Splunk event body, and derives Splunk classification metadata from the event itself rather than a fixed value, so your events remain searchable by their original Twilio event type and source.

Field	Splunk field
Event payload	`event` (the searchable event body)
Event type	`sourcetype`, and indexed field `event_type`
Event source	`source`, and indexed field `event_source`
Event ID	Indexed field `event_id`
Event time (RFC 3339)	Indexed field `event_time`

Twilio doesn't convert the event timestamp into the Splunk numeric time field, so Splunk assigns index time instead. The original timestamp is preserved both inside the event body and as the indexed event_time field, so no data is lost.

Verification and troubleshooting

When you save a Splunk destination, Twilio runs two checks before marking it active:

A read-only GET /services/collector/health request, confirming Splunk HEC is reachable. This check doesn't require a token, so it can't confirm your HEC Token is valid.
A probe POST /services/collector/event request with a minimal test event, which does exercise your HEC Token. This writes one test event to your configured index.

If validation fails, check that:

Your Base URL is correct and reachable from the public internet.
Your HEC Token is correct, enabled, and hasn't been revoked in Splunk.
If you set an Index, it already exists in Splunk and is included in your HEC token's allowed index list.

Twilio doesn't currently offer a way to manually trigger a test event for this destination, from either the Console or the CLI. To confirm delivery is working, wait for a real event of a subscribed type to fire.

Common errors

Cause	What you'll see	Fix
Invalid, disabled, or revoked HEC Token	Delivery fails with an auth error (HTTP 401 or 403)	Re-check the token in Splunk Web and confirm it's enabled, then update the destination
Unreachable or incorrect Base URL	Validation fails, or delivery errors are reported in the Debugger	Confirm the base URL, including the port, and that it's reachable from the internet
Index doesn't exist, or isn't allowed for the token	Delivery fails (HTTP 400)	Create the index in Splunk, or add it to the token's allowed index list
Splunk HEC queue is full, or ACK channel is at capacity (HTTP 429)	Delivery fails, retried automatically	Retry is automatic. Sustained errors may indicate your Splunk deployment needs more indexer capacity
Splunk HEC is busy or its queues are full (HTTP 503)	Delivery fails, retried automatically	Retry is automatic. Check your Splunk deployment's health if this persists

If Twilio can't deliver events to your destination, Twilio sends an error notification to the Debugger (available in US1 region only). If Twilio continues to encounter delivery errors, Twilio notifies you every 20 minutes after the initial error.