• Overview
• Prerequisites
• Step 1: Enable HEC and create a token in Splunk
• Step 2: Store the token as a Cribl secret
• Step 3: Allow Cribl Stream to reach Splunk
• Step 4: Create the Splunk HEC Destination in Cribl Stream
• Step 5: Route events to Splunk
• Step 6: Verify events in Splunk
• Related

Overview

This page completes the pipeline described in Set Up Cribl Stream for SIEM Integration. That page covers the CSE side: the API key, the REST Collector, the Event Breaker, and the schedule. This page covers the Splunk Enterprise side: the HTTP Event Collector (HEC) input in Splunk, and the Cribl Destination that delivers events to it.

The pipeline works as follows:

1. The Cribl REST Collector pulls events from the CSE Events API on a schedule.
2. A Cribl Route sends the events to a Splunk HEC Destination.
3. The Destination posts the events over HTTPS to the HEC input on Splunk Enterprise (default port 8088).

Prerequisites

• The Collector, Event Breaker, and schedule from Set Up Cribl Stream for SIEM Integration, completed through Step 5.
• Splunk Enterprise, with an administrator account that can create indexes and HEC tokens.
• Network reachability from Cribl Stream to the Splunk HEC port (default 8088). See Step 3.

Step 1: Enable HEC and create a token in Splunk

1.1 In Splunk Web, navigate to Settings > Data > Indexes, and select New Index. Create an index for CSE events, for example cse_events.

1.2 Navigate to Settings > Data > Data inputs. Select HTTP Event Collector, and then select Global Settings.

1.3 Configure the global settings:

1.4 Select Save.

1.5 Select New Token. Name the token cribl_cse_events, and leave Enable indexer acknowledgement off. If it is on, Splunk expects a channel ID with every request, and requests from Cribl Stream fail with a “Data channel is missing” error.

1.6 Select Next.

1.7 Under Select Allowed Indexes, select the cse_events index, and make sure that cse_events is selected as the Default Index.

1.8 Select Review.

1.9 Select Submit.

1.10 Copy the Token Value.

Step 2: Store the token as a Cribl secret

2.1 In Cribl Stream, select your Worker Group, and then select Worker Group Settings. Expand the Security menu, and select Secrets.

2.2 Select Add Secret.

2.3 Configure the secret:

• Secret ID: splunk_token
• Secret type: Text
• Value: the Token Value that you copied in Step 1.10

2.4 Select Save.

Step 3: Allow Cribl Stream to reach Splunk

Splunk sees the public source IP address of the Cribl Workers, not the address that Cribl Stream uses internally. Use that public address in your NAT, firewall, or security group rules.

3.1 In Cribl Stream, select your Worker Group, and record the Egress IP(s) under the Worker Group Information section.

3.2 Allow inbound TCP traffic on the HEC port (default 8088) from the Cribl Stream egress IP addresses to the Splunk host.

Note: Cribl.Cloud egress IP addresses can change, for example during Cribl upgrades or maintenance. If events stop reaching Splunk, compare the addresses in your firewall rules with the current Egress IP(s) under Worker Group Information.

Step 4: Create the Splunk HEC Destination in Cribl Stream

4.1 In Cribl Stream, select your Worker Group, and open Destinations from the Data menu.

4.2 Select Splunk HEC, and select Add Destination.

4.3 In the General Settings section, configure the following:

4.4 Under Advanced Settings, set Validate server certs to match the certificate that Splunk presents:

• If Splunk uses its default self-signed certificate, turn Validate server certs off.
• If Splunk uses a certificate signed by a trusted certificate authority, leave Validate server certs on.

If you turn Validate server certs off, Cribl Stream accepts any certificate, so it does not confirm that it is sending the HEC token and your events to your own Splunk server. To keep validation on, give HEC a certificate signed by a trusted certificate authority.

4.5 Select Save. Cribl Stream reports the Destination as healthy after it connects.

Step 5: Route events to Splunk

5.1 Navigate to Routing > Data Routes, select Add Route, and configure the route:

• Route name: cse_events_to_splunk
• Filter: __inputId.endsWith('cse_events')
• Pipeline: passthru
• Output: the splunk_cse Destination that you created in Step 4

5.2 Move the route above any catch-all routes, and select Save.

5.3 Select Commit & Deploy to push the changes to production.

Step 6: Verify events in Splunk

6.1 Wait for the next scheduled collection, or run the Collector manually in Full Run mode.

6.2 In Splunk Web, open Search & Reporting, and search for:

index=cse_events

6.3 Confirm that each result is one CSE event, and that the event time matches the created_at value.

Related

• Set Up Cribl Stream for SIEM Integration
• Event Properties and Definitions, for the fields in each event