Stream logs to Splunk

A Splunk log stream sends each request of a gateway environment to a Splunk HTTP Event Collector (HEC) as one event, about 30 seconds after the request ends.

Before you begin

• An HTTP Event Collector input in Splunk and its token. Create it under Settings > Data inputs > HTTP Event Collector. See Set up and use HTTP Event Collector in the Splunk docs.
• The collector has to be reachable from the internet over https://.

Add the stream

1. In the portal, go to Agent Gateway and select your gateway.
2. Select the Logs tab, then Log settings.
3. Under Log streams, select Add a stream.
4. Under Destination, select Splunk.
5. Fill in the fields in the table.
6. Select Send test event. Faustine sends one event marked test: true and shows Delivered when Splunk accepts it.
7. Select Continue.
8. Under What to send, choose All requests or Errors and denials, and turn on Discovery calls or Payloads if you want them. Select Continue.
9. Under Review and create, enter a Name and select Create stream.

The stream's page opens. The first event reaches Splunk about 30 seconds after the next request ends.

What Splunk receives

Faustine posts the requests to the endpoint in batches. The body has one HEC event per line.

{
  "time": 1794400000.123,
  "host": "<gateway>",
  "source": "faustine",
  "sourcetype": "faustine:gateway:request",
  "event": { "schema": "faustine.gateway.request/v1", "id": "req_…", "status": "ok" }
}

time is when the request started and host is the gateway's slug. event is the whole request: its calls, the exchanges with your API and, if the stream includes them, its payloads. For its fields, see Log streams.

To find the events, search for sourcetype="faustine:gateway:request".

Troubleshooting

Next steps

• Log streams: delivery, retries and the fields of a request.
• Redact sensitive fields: decide what a stream can carry.
• Set recording and retention: record the payloads a stream sends.