Splunk

The Splunk integration sends selected VeriProof governance events to an HTTPS HTTP Event Collector (HEC) endpoint. It supports Splunk Cloud and public Splunk Enterprise HEC endpoints reachable from VeriProof SaaS.

Why VeriProof sends directly to HEC

Use HEC when you need individual governance events in a Splunk index. No OpenTelemetry Collector is required.

OpenTelemetry metrics sends aggregate measurements, not this event feed. Choose the integration for the data you need.

Delivery is at least once. VeriProof keeps the same event_id when it retries an event. The included dashboard collapses repeated copies by event_id while retaining the newest indexed copy.

Before you start

You need:

VeriProof administrator access.
A Splunk HEC token that can write to the intended index.
The HEC event endpoint, such as https://inputs.example.splunkcloud.com:8088/services/collector/event.
Access to search the target Splunk index.
Application groups if the destination must cover only part of your VeriProof organization.

Create the HEC token

In Splunk, create an HTTP Event Collector token. Allow it to write only to the index that will hold VeriProof events.

Add the destination

In VeriProof, open Settings, then Splunk. Enter a clear destination name, the HEC event endpoint, token, and index.

Use the endpoint shown for your Splunk instance. VeriProof stores it only for this tenant. Splunk Cloud host prefixes differ by hosting platform, and free trials can use port 8088.

For a trial endpoint with a self-signed certificate, add the exact SHA-256 leaf certificate fingerprint shown by your administrator. Leave this field empty when Splunk presents a certificate trusted by the VeriProof runtime.

Choose the scope

Choose all applications or selected application groups. Then choose the environments and event types Splunk needs. Completed governed sessions is off by default because it can add substantial event volume.

Set delivery limits

Keep the default event-rate, daily-byte, and event-size limits unless the Splunk index owner approves another budget. VeriProof records suppressed counts and pauses delivery when a configured volume limit is reached.

Save and test

Save the destination with delivery off. Select Test connection, then search Splunk for the exact test event ID shown by VeriProof.


index=<your-index> sourcetype="veriproof:governance:alert" event_id="<test-event-id>"

Confirm the event

After the event appears in Splunk, select Confirm in Splunk in VeriProof. The destination now shows Connected. This confirmation proves that the endpoint, token, index, and search access agree.

Turn delivery on

Select Enable delivery. VeriProof starts durable delivery for new in-scope events and shows sent, suppressed, and failed delivery state.

Install the VeriProof add-on

Install integrations/splunk/TA-veriproof on the Splunk search tier. The configuration-only add-on:

identifies veriproof:governance:alert and veriproof:governance:audit source types;
maps governance alerts to the Splunk Common Information Model Alerts data model;
provides a filtered VeriProof governance dashboard; and
adds an Open session action to each recent event that has a veriproof_url.

The dashboard action opens a new browser tab. VeriProof still applies the signed-in user’s tenant, role, and application access.

Open VeriProof Governance in Splunk to review activity without writing SPL. Choose the index, time range, application, environment, and event type. Select Open session in the recent activity table to open the matching VeriProof record.

Search governance activity

Use this search to review analyst-ready fields:


index=<your-index> sourcetype="veriproof:governance:alert"
| table _time event_type application_name environment action severity signature signature_id governance.sessionId governance.outcome governance.riskLevel veriproof_url

The HEC event and VeriProof add-on already extract these JSON fields. Do not add spath to this search because it would append the same values a second time.

Use the Alerts data model after installing the add-on:


| datamodel Alerts Alerts search
| search sourcetype="veriproof:governance:alert"

Data boundary

VeriProof sends event identity, application identity, environment, outcome, risk, rule or anomaly identifiers, delivery metadata, and an authorized VeriProof link when applicable. It does not send prompts, responses, evidence content, borrower details, or subject data.

A Splunk event can identify a VeriProof session without copying the governed session content. Open VeriProof when an authorized investigation needs that record.

Delivery states

Connected means an administrator confirmed a test event in Splunk.
Delivery on means new in-scope events are eligible for delivery.
Needs attention means delivery failed and requires administrator action. VeriProof also sends a configured administrator notification when this state begins.
Volume paused means a configured rate or daily-byte limit stopped additional delivery. VeriProof retains suppression counts and sends a recovery summary after delivery resumes.

If an event does not arrive

Confirm that the destination is both connected and enabled.
Search the correct index and use the exact event ID.
Confirm that the application, environment, and event type are in scope.
Check the destination delivery list for a retry, volume pause, or permanent rejection.
Confirm that the HEC token can write to the selected index.
Confirm that the endpoint is the HEC event endpoint, not the Splunk search URL.