• To configure your Splunk authentication and index settings

    1. Copy the Splunk HTTP Event Collector token provided by your Splunk deployment into the Token field.

      Because the Splunk HTTP Event Collector token permits SSB to send messages to Splunk, configuring the Token field is required for the Splunk destination.

      For details about setting up and using the Splunk HTTP Event Collector token on your Splunk deployment, see Set up and use HTTP Event Collector in Splunk Web.

    2. Enter the name of the Splunk index where Splunk will store the messages received from SSB into the Index field.

      Configuring the Index field is required for the Splunk destination.

    3. (Optional) Enable Use proxy to use a proxy address while forwarding messages to your Splunk deployment.

    NOTE: When configuring your proxy address, consider the following:

    • Only HTTP proxy type is supported.

    • Authenticated proxy types are not supported.