Splunk Integration

Prerequisites

Step 1: Create HEC Token

The HTTP Event Collector (HEC) token allows StackFlow to forward logs and events to Splunk.

1. In Splunk Web, go to Settings → Data Inputs → HTTP Event Collector → New Token
2. Name it StackFlow Events
3. Set the Source Type to _json
4. Set the Default Index to your preferred index (e.g., itsm_events)
5. Click Review and Submit
6. Copy the generated token value

Step 2: Configure Saved Search to Incident

Configure Splunk saved searches to trigger StackFlow incident creation via webhook alert actions:

1. Create or edit a saved search in Splunk
2. Under Alerts → Add Actions → Webhook, set the URL to: https://your-instance.stackflow-tech.com/prod/api/webhooks/inbound/splunk
3. Set the payload to the StackFlow Splunk payload template:

{
  "search_name": "$name$",
  "result_count": "$job.resultCount$",
  "search_uri": "$job.searchId$",
  "severity": "$result.severity$",
  "host": "$result.host$",
  "source": "$result.source$",
  "message": "$result.message$",
  "stackflow_priority": "$result.stackflow_priority$",
  "stackflow_assignment_group": "$result.stackflow_assignment_group$",
  "timestamp": "$trigger_time$"
}

4. Add a custom header: X-StackFlow-Secret: YOUR_WEBHOOK_SECRET

Step 3: Notable Event Mapping

For organizations using Splunk Enterprise Security, StackFlow can consume Notable Events from the notable index and create ITSM records:

{
  "notable_event_mapping": {
    "search": "index=notable | search status=new earliest=-15m | table event_id, rule_name, severity, dest, src, owner",
    "poll_interval_minutes": 5,
    "severity_mapping": {
      "critical": "P1",
      "high": "P2",
      "medium": "P3",
      "low": "P4"
    },
    "field_mapping": {
      "short_description": "rule_name",
      "ci_identifier": "dest",
      "source_ip": "src"
    }
  }
}

Step 4: Log Forwarding to Splunk

StackFlow can forward incident, change, and audit log data to Splunk via HEC for SIEM analysis:

# Verify HEC is accepting events
curl -k https://splunk-host:8088/services/collector/event   -H "Authorization: Splunk YOUR_HEC_TOKEN"   -H "Content-Type: application/json"   -d '{"event": {"source": "stackflow", "type": "test", "message": "HEC connectivity test"}, "sourcetype": "_json"}'

# Expected: {"text":"Success","code":0}

Configure forwarded event types in Admin → Integration Hub → Splunk → Log Forwarding:

Step 5: Connect in StackFlow

1. Navigate to Admin → Integration Hub → Splunk → Configure
2. Enter the Splunk HEC URL and HEC token
3. Configure the saved search webhook secret
4. Configure Notable Event polling (if using Splunk ES)
5. Enable and configure log forwarding
6. Click Save & Test

Field Reference

Testing the Integration

1. Click Test HEC Connection to verify Splunk HEC is reachable and the token is valid
2. Manually send a test Splunk alert payload and verify an incident is created
3. Create a StackFlow incident and verify the log event appears in Splunk within 60 seconds

# Test inbound Splunk webhook
curl -X POST   https://your-instance.stackflow-tech.com/prod/api/webhooks/inbound/splunk   -H "Content-Type: application/json"   -H "X-StackFlow-Secret: YOUR_SECRET"   -d '{"search_name":"High Error Rate","severity":"high","host":"app-server-01","message":"Error rate exceeded 10%","stackflow_priority":"P2","stackflow_assignment_group":"Platform Engineering"}'

Troubleshooting