# Stream logs to Splunk

A Splunk log stream sends each request of a gateway environment to a Splunk HTTP Event Collector (HEC) as one event, about 30 seconds after the request ends.

## Before you begin

- An HTTP Event Collector input in Splunk and its token. Create it under **Settings** > **Data inputs** > **HTTP Event Collector**. See [Set up and use HTTP Event Collector](https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector) in the Splunk docs.
- The collector has to be reachable from the internet over `https://`.

## Add the stream

1. In the portal, go to [**Agent Gateway**](https://auth.faustine.ai/go?to=%2Fintegrations%2Fagent-gateway) and select your gateway.
2. Select the **Logs** tab, then **Log settings**.
3. Under **Log streams**, select **Add a stream**.
4. Under **Destination**, select **Splunk**.
5. Fill in the fields in the table.
6. Select **Send test event**. Faustine sends one event marked `test: true` and shows **Delivered** when Splunk accepts it.
7. Select **Continue**.
8. Under **What to send**, choose **All requests** or **Errors and denials**, and turn on **Discovery calls** or **Payloads** if you want them. Select **Continue**.
9. Under **Review and create**, enter a **Name** and select **Create stream**.

| Field | Value |
| --- | --- |
| **HEC endpoint** | The URL of the collector, with the `/services/collector/event` path, such as `https://http-inputs-<stack>.splunkcloud.com/services/collector/event`. |
| **HEC token** | The token of the collector input. |

The stream's page opens. The first event reaches Splunk about 30 seconds after the next request ends.

## What Splunk receives

Faustine posts the requests to the endpoint in batches. The body has one HEC event per line.

```json
{
  "time": 1794400000.123,
  "host": "<gateway>",
  "source": "faustine",
  "sourcetype": "faustine:gateway:request",
  "event": { "schema": "faustine.gateway.request/v1", "id": "req_…", "status": "ok" }
}
```

`time` is when the request started and `host` is the gateway's slug. `event` is the whole request: its calls, the exchanges with your API and, if the stream includes them, its payloads. For its fields, see [Log streams](https://docs.faustine.ai/agent-gateway/log-streams/).

To find the events, search for `sourcetype="faustine:gateway:request"`.

## Troubleshooting

| Symptom | Cause | Fix |
| --- | --- | --- |
| The test shows "Splunk rejected the HEC token." | The token is wrong or the input is disabled. | Copy the token of the input again and check that the input is enabled. |
| The test shows "Nothing at that path" | The URL does not end in `/services/collector/event`. | Use the event endpoint of the collector. |

## Next steps

- [Log streams](https://docs.faustine.ai/agent-gateway/log-streams/): delivery, retries and the fields of a request.
- [Redact sensitive fields](https://docs.faustine.ai/agent-gateway/redact-sensitive-fields/): decide what a stream can carry.
- [Set recording and retention](https://docs.faustine.ai/agent-gateway/retention/): record the payloads a stream sends.