--- "@context": https://schema.org "@type": TechArticle "@id": https://www.twilio.com/docs/data-destinations/destination/splunk#article headline: Splunk destination description: Learn how to send event data to Splunk through the HTTP Event Collector (HEC) for search, monitoring, and analytics. url: https://www.twilio.com/docs/data-destinations/destination/splunk inLanguage: en dateModified: 2026-11-04T17:24:28.000Z author: "@type": Organization name: Twilio Developer Education Team publisher: "@type": Organization name: Twilio --- # Splunk destination > \[!IMPORTANT] > > Data Destinations is currently available as a Private Beta product and the information contained in this document is subject to change. Data Destinations is not a HIPAA Eligible Service or PCI compliant and should not be enabled in workflows that are subject to HIPAA or PCI. To learn more, see [Private beta legal information](/docs/data-destinations#private-beta-legal-information). [Splunk](https://www.splunk.com/) is a platform for searching, monitoring, and analyzing machine-generated data. Send your events to the Splunk HTTP Event Collector (HEC) to make them searchable alongside your existing logs, metrics, and events. Your HEC endpoint must be publicly reachable; self-hosted deployments on a private network aren't supported. ### Destination overview * **Category**: Analytics * **Release status**: Beta * **Authentication**: HEC token * **Regional availability**: US1 ## Join the Data Destinations private beta [Sign up](https://airtable.com/appaJfyV6LiIFMxuP/pagIaOAtKsQVxTfdW/form) Get early access to native destinations for data warehouses, observability tools, and event pipelines. ## Eligible events You can send all [Event Types](/docs/events/event-types-overview) supported by Event Streams to Splunk. There's no user-identifier restriction for this destination. ## Get started ### Prerequisites Before you set up a Splunk destination, make sure you have: * A Splunk deployment with HTTP Event Collector (HEC) turned on. Use Splunk Cloud, or Splunk Enterprise with a publicly reachable HEC endpoint. Self-hosted deployments on a private network aren't supported. On Enterprise, an admin must turn on **All Tokens** under **Settings** > **Data Inputs** > **HTTP Event Collector** > **Global Settings**. On Splunk Cloud, HEC is on by default. * An HEC token created in Splunk Web (**Settings** > **Data Inputs** > **HTTP Event Collector**), with an allowed index list that includes the index you want Twilio to write to. * Your HEC **base URL**, for example `https://http-inputs-.splunkcloud.com:443` (Splunk Cloud) or `https://:8088` (Splunk Enterprise). ## Create the destination > \[!NOTE] > > See [Set up a destination](/docs/data-destinations/destination-setup) for the full UI and Destinations API setup flow common to every destination type. ### Twilio Console To create a Splunk destination in the Twilio Console: 1. From your Splunk account, gather the settings listed in [Destination settings](#destination-settings). 2. In the Twilio Console, go to **Data** > **Data Destinations** > **Destinations** > **Add destination subscription**. 3. Complete the **Add destination subscription** wizard. ### Destinations API To create a Splunk destination through the Destinations API, send a `POST` request to the Destinations endpoint and set `destinationType` to `splunk`. For authentication and the other request body fields, see [Create a destination](/docs/data-destinations/api-quickstart#create-a-destination). ```text title="Create a destination" POST "https://destinations.twilio.com/v1/ControlPlane/Destinations" ``` Set the `config` object in the request body as follows: | Name | Type | Description | | ------------------------------------------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `baseUrl`
(**Required**) | string | Your HTTP Event Collector (HEC) base URL, for example `https://http-inputs-HOST.splunkcloud.com:443` (Splunk Cloud) or `https://HOST:8088` (Splunk Enterprise). Twilio appends `/services/collector/event` automatically. | | `credentials.credentialType`
(**Required**) | string | Set to `API_KEY`. | | `credentials.token`
(**Required**) | string | Your HEC token (a 32-character GUID). | | `host` | string | The default `host` value. You can override it for each event. | | `index` | string | The default Splunk index for delivered events. The index must already exist in Splunk. You can override it for each event. | | `source` | string | The default `source` value. You can override it for each event. | | `sourcetype` | string | The default `sourcetype` value. You can override it for each event. | The following example shows a request body. Replace the uppercase placeholder values with your own. ```json title="Example request body" { "destinationType": "splunk", "name": "My Splunk destination", "config": { "baseUrl": "BASE_URL", "credentials": { "credentialType": "API_KEY", "token": "TOKEN" } } } ``` ## Destination settings Use `splunk` as the `destinationType`. | Field | Description | Required | Default or choices | | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------------------ | | Base URL | Your HEC base URL, for example `https://http-inputs-.splunkcloud.com:443` (Cloud) or `https://:8088` (Enterprise). Twilio appends `/services/collector/event` automatically. | Yes | None | | HEC Token | Your HEC token (a 32-character GUID). Sent as `Authorization: Splunk `. Sensitive: entered once and stored encrypted. | Yes | None | | Index | Default Splunk index for delivered events. Must already exist in Splunk. Can be overridden per event through your mapping. | No | None | | Sourcetype | Default sourcetype classification. Can be overridden per event through your mapping. | No | None | | Source | Default source name. Can be overridden per event through your mapping. | No | None | | Host | Default host value. Can be overridden per event through your mapping. | No | None | Twilio authenticates to Splunk by using your **HEC Token**, sent as an `Authorization: Splunk ` header on every event delivered. The scheme word is `Splunk`, not `Bearer`. ## Default mappings Twilio forwards the full event payload as the searchable Splunk event body, and derives Splunk classification metadata from the event itself rather than a fixed value, so your events remain searchable by their original Twilio event type and source. | Field | Splunk field | | --------------------- | -------------------------------------------- | | Event payload | `event` (the searchable event body) | | Event type | `sourcetype`, and indexed field `event_type` | | Event source | `source`, and indexed field `event_source` | | Event ID | Indexed field `event_id` | | Event time (RFC 3339) | Indexed field `event_time` | Twilio doesn't convert the event timestamp into the Splunk numeric `time` field, so Splunk assigns index time instead. The original timestamp is preserved both inside the event body and as the indexed `event_time` field, so no data is lost. ## Verification and troubleshooting When you save a Splunk destination, Twilio runs two checks before marking it active: 1. A read-only `GET /services/collector/health` request, confirming Splunk HEC is reachable. This check doesn't require a token, so it can't confirm your HEC Token is valid. 2. A probe `POST /services/collector/event` request with a minimal test event, which does exercise your **HEC Token**. This writes one test event to your configured index. If validation fails, check that: * Your **Base URL** is correct and reachable from the public internet. * Your **HEC Token** is correct, enabled, and hasn't been revoked in Splunk. * If you set an **Index**, it already exists in Splunk and is included in your HEC token's allowed index list. Twilio doesn't currently offer a way to manually trigger a test event for this destination, from either the Console or the CLI. To confirm delivery is working, wait for a real event of a subscribed type to fire. ### Common errors | Cause | What you'll see | Fix | | ------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | | Invalid, disabled, or revoked HEC Token | Delivery fails with an auth error (HTTP 401 or 403) | Re-check the token in Splunk Web and confirm it's enabled, then update the destination | | Unreachable or incorrect Base URL | Validation fails, or delivery errors are reported in the [Debugger](/docs/usage/troubleshooting/debugging-your-application) | Confirm the base URL, including the port, and that it's reachable from the internet | | Index doesn't exist, or isn't allowed for the token | Delivery fails (HTTP 400) | Create the index in Splunk, or add it to the token's allowed index list | | Splunk HEC queue is full, or ACK channel is at capacity (HTTP 429) | Delivery fails, retried automatically | Retry is automatic. Sustained errors may indicate your Splunk deployment needs more indexer capacity | | Splunk HEC is busy or its queues are full (HTTP 503) | Delivery fails, retried automatically | Retry is automatic. Check your Splunk deployment's health if this persists | If Twilio can't deliver events to your destination, Twilio sends an error notification to the [Debugger](/docs/usage/troubleshooting/debugging-your-application) (available in US1 region only). If Twilio continues to encounter delivery errors, Twilio notifies you every 20 minutes after the initial error. ## Additional resources * [Destinations overview](/docs/data-destinations/destinations-overview) * [Set up a destination](/docs/data-destinations/destination-setup) * [Event types reference](/docs/events/event-types-overview)