The Files.com integration with Splunk Enterprise and Splunk Cloud uses Splunk's HTTP Event Collector to send Files.com logs directly into your Splunk environment for near real-time analysis. You choose which log types are forwarded.

Logs are sent in JSON format over HTTP, which is the format Splunk's data ingestion pipeline expects. The same integration works for Splunk Enterprise on-premise and Splunk Cloud. Files.com also provides a separate Splunk Compatible integration for platforms that support Splunk's HEC protocol but are not Splunk itself.

Getting Started with Splunk Integration

Files.com uses Splunk's HTTP Event Collector (HEC) to send audit logs and actions to a Splunk deployment over HTTP or HTTPS with token-based authentication. Generate a token in Splunk, and Files.com will transmit logs to HEC in JSON format. No Splunk forwarder is needed.

See Splunk's documentation on setting up and using the HTTP Event Collector in Splunk Web for more details.

When configuring Splunk's HEC, select Automatic for the Source type if prompted. Leave the index options at their default settings. Do not enable indexer acknowledgment. Files.com records delivery as successful when HEC returns a successful HTTP response; it does not make the additional status queries required by Splunk's indexer acknowledgment protocol. A successful delivery in Files.com confirms HTTP acceptance, not that Splunk has finished indexing the events.

Configuring Files.com for Splunk Integration

When configuring the Splunk integration in Files.com, provide a Name for the integration for your records. Specify the HTTP Event Collector Host or URI (the HEC URI) from your Splunk HEC configuration as the Destination URL in Files.com. For authentication, use the HTTP Event Collector Token from the same Splunk HEC configuration as the Splunk token in Files.com.

The HEC URI format for Splunk Cloud is: <protocol>://http-inputs-<host>.splunkcloud.com:<port>/<endpoint> (for example, https://http-inputs-myhostname.splunkcloud.com:443/services/collector/event).

The HEC URI format for Splunk Enterprise is: <protocol>://<host>:<port>/<endpoint> (for example, https://myhostname:8088/services/collector/event).

The HEC URI varies based on the geo-region or third-party cloud platform hosting your instance, and whether you are using a Splunk trial or demo account. The http-inputs- segment may not be required for the Splunk Cloud trial version. See Splunk's documentation for the correct HEC URI for your environment, which you then enter as the Destination URL in Files.com.

If you need to pass extra headers to your SIEM setup, configure them by entering each Header Name and Header Value in the Key and Value fields.

Select log categories, then verify delivery and check connection problems. For receiver-specific diagnosis, see the provider documentation.