Ship logs to Splunk

Use this guide to stream your Audit Logs to a Splunk HTTP Event Collector. Splunk Cloud and Splunk Enterprise are both supported.

Step 1: Create an HEC token

In Splunk, go to Settings → Data Inputs → HTTP Event Collector:

  1. Click Global Settings and make sure All Tokens is enabled.
  2. Click New Token, give it a name such as firezone, and complete the wizard. Optionally select a default index for the token.
  3. Copy the token value.

Step 2: Create the Log Sink in Firezone

In the admin portal, go to SettingsLog Sinks, click Add, and select Splunk. Configure the sink:

FieldDescription
NameA name to identify this log sink.
HEC URLThe base URL of your Splunk HTTP Event Collector, for example https://http-inputs-acme.splunkcloud.com.
HEC TokenThe HTTP Event Collector token to authenticate with.
IndexOptional. The Splunk index to send events to. When left blank, the token's default index is used.

Paste the base URL only. Firezone appends /services/collector/event itself, and strips a trailing /services/collector or /services/collector/event if you paste one. The URL must be HTTPS, and hostnames that resolve to private or reserved IP addresses are rejected.

Then choose which Log streams to deliver, all four of which are enabled by default, and optionally check Deliver existing logs to backfill logs recorded before the sink was created.

Deliver existing logs can only be selected when you create the sink. It can't be turned on later for an existing sink.

Click Create. Deliveries begin within about a minute.

Delivery format

Firezone POSTs batches to <HEC URL>/services/collector/event, with each event wrapped in a HEC envelope: time is the event's epoch timestamp, source is firezone, and sourcetype is firezone:<stream>. That means you can search all Firezone events with sourcetype=firezone:*. Batches stay under 512 KB, well below Splunk Cloud's 1 MB HEC limit.

{
  "time": "1784021191.114",
  "source": "firezone",
  "sourcetype": "firezone:change",
  "event": {
    "type": "change",
    "log_id": "c0654d20aa1b4a0000000002",
    "timestamp": "2026-07-14T09:26:31.114213Z",
    "object": "policies",
    "operation": "update",
    "before": { "id": "0a83588e-…", "description": "Engineering → GitLab" },
    "after": {
      "id": "0a83588e-…",
      "description": "Engineering → GitLab (MFA required)"
    },
    "subject": {
      "actor_id": "e2f6a9c4-…",
      "actor_name": "Jamie Admin",
      "actor_email": "jamie@company.com",
      "actor_type": "account_admin_user",
      "auth_provider_id": "9d0c2f4e-…",
      "ip": "203.0.113.44",
      "ip_region": "US",
      "ip_city": "San Francisco",
      "ip_lat": 37.7749,
      "ip_lon": -122.4194,
      "user_agent": "Mozilla/5.0 …"
    }
  }
}

How Firezone responds to HTTP status codes

ResponseBehavior
200The batch is accepted and delivery advances.
200 with HEC code 24/25Accepted, but Splunk reports its queues are near capacity. Firezone logs the warning.
408, 429, 5xxRetried every minute. If failures persist for 24 hours, the sink is disabled and account admins are emailed.
413The batch is split in half and retried to isolate an oversized event.
400 with HEC code 6, 12, 13, 15The batch is bisected to isolate the rejected event. Delivery for that stream pauses at it and Firezone engineers are notified automatically. No entries are skipped.
Other 4xx or a redirectTreated as a configuration error: the sink is disabled immediately. A redirect usually means the URL is missing the HEC port, often 8088 on Splunk Enterprise.

Duplicates and redelivery

Firezone guarantees at-least-once delivery, retrying any batch that isn't acknowledged rather than risk losing data, so Splunk can occasionally receive the same event twice. When it does, deduplicate on event.log_id: flow start and end events are already suffixed with -s and -e, which makes the log_id a unique key across all streams.

Recovering a failed sink

A sink showing Warning is retrying automatically, so unless the underlying cause, such as HEC queue pressure, persists, there's nothing you need to do. A sink showing Error has stopped delivering and needs attention: fix the cause , commonly an invalid or disabled HEC token, then open the sink, click Edit, and click Save to re-enable it. Delivery picks up right where it left off, from the last acknowledged entry, and Deliver Now triggers a delivery immediately if you don't want to wait for the next cycle.

Deleting the sink deletes its delivery state along with it, so re-creating it starts fresh: the new sink delivers logs recorded from its creation onward, plus a full backfill if Deliver existing logs is selected, which re-sends events Splunk may already have.

Need help? See all support options.

Found a problem with this page? Open an issue
Last updated: July 20, 2026