> This page is for Data Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.eon.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server.

# Manage Notification Policies for Splunk

This article explains how to create notification policies that send notifications to Splunk via the HTTP Event Collector (HEC).

Eon sends audit log events to Splunk.
To connect Eon to Splunk, you need a Splunk HEC URL and an authentication token.

## Create a notification policy for Splunk

### Before you start

Make sure you have access to your Splunk instance with permissions to manage HEC tokens.

#### Find your Splunk HEC URL

Your Splunk HEC URL is the endpoint Eon sends events to.
The format depends on whether you're using Splunk Enterprise or Splunk Cloud Platform:

| Platform              | HEC URL format                                                               |
| --------------------- | ---------------------------------------------------------------------------- |
| Splunk Enterprise     | `https://{your-splunk-server}:8088/services/collector/event`                 |
| Splunk Cloud Platform | `https://http-inputs-{yourcompany}.splunkcloud.com/services/collector/event` |

Replace `{your-splunk-server}` or `{yourcompany}` with your instance's hostname.
Note your HEC URL because you'll need it when configuring the notification policy in Eon.

#### Create a HEC token

In this step, you'll create an authentication token that Eon uses to send events to your Splunk instance.

1. In Splunk, go to **Settings > Data Inputs**, and then select **HTTP Event Collector**.

2. If HTTP Event Collector is not enabled, click **Global Settings**, set **All Tokens** to **Enabled**, and click **Save**.

3. Click **New Token**.
   The **Add Data** wizard opens.

   ![Screenshot of the Splunk Add Data wizard showing the token name field and Select Source step.](/_fern-img/671ea6976ca6e9f407bbfeb85fbccfac4ee94831220d0d1e6d4d70049333a14b.webp)

4. Enter a meaningful **Name** for the token (for example, `Eon notifications`)., then click **Next**.

5. On the **Input Settings** page, accept the defaults or configure a source type and index, then click **Review**.

6. Review the settings and click **Submit**.
   A success message and your HEC token are shown.

   ![Screenshot of the Splunk HEC token confirmation page showing the generated token value.](/_fern-img/ffe97efcdf0b78f1a4d45260bb49440fc1925db55d2d7e2759983b0f23b296c5.webp)

7. Copy the token value shown on the confirmation page.
   Save it in a temporary location so you can provide it in Eon.

   > **Warning**
   >
   > The token value is shown only once after creation.
   > If you navigate away without copying it, you'll need to create a new token.

#### Create the notification policy in Eon

In this step, you'll use the HEC URL and token from the previous steps.
Log in to your Eon project to complete this step:

1. In your project's

   Notification Policies

   page in the Eon console, click **  Create Notification Policy**.
   The **Create a Notification Policy** wizard opens.

2. Enter a **Notification policy name** that describes the Splunk instance notifications will be sent to.

3. Choose the **Splunk** notification channel type, then click **Next**.

4. Enter these values:

   | Field       | Value                                               |
   | ----------- | --------------------------------------------------- |
   | **HEC URL** | Your Splunk HEC URL from [Find your Splunk HEC URL] |
   | **Token**   | The token you created in [Create a HEC token]       |

   [Find your Splunk HEC URL]: #find-your-splunk-hec-url

   [Create a HEC token]: #create-a-hec-token

5. Click **Test and Create**.

Eon sends a test event to your Splunk HEC endpoint to confirm the connection.

If the test succeeds, the notification policy is created.

If the test fails, check that the HEC URL and token are correct, and that HTTP Event Collector is enabled in your Splunk instance.

Your notification policy is now set up, and Eon will send audit log events to your Splunk instance when subscribed events happen.

## See also

* [About Notification Policies](/data-protection/integrations/notifications/about-notification-policies)