# How to use Splunk to receive data from Data Stream

import Tabs from '~/components/tabs/Tabs'


While configuring [streams](/en/documentation/products/observe/data-stream/), you need to set up a specific endpoint to stream your Azion data.

Continue reading for a step by step on how to connect an [Splunk](https://www.splunk.com/) endpoint to receive data from Data Stream.

---

## Splunk requirements

To use **Splunk** as a destination for your logs, you'll need to:

1. Create a [Splunk account](https://www.splunk.com/en_us/download/splunk-cloud.html).
2. Create and configure a [HTTP Event Collector (HEC)](https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector#Set_up_and_use_HTTP_Event_Collector_in_Splunk_Web) instance corresponding to the type of Splunk instance you're using.
3. Save your event collector URL.
4. Create a [HEC token](https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector#Create_an_Event_Collector_token).
5. [Enable the created HEC token](https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector#Enable_and_disable_Event_Collector_tokens).
6. Save the HEC token you've enabled and your event's connector URL.

The URL structure for your event collector varies depending on the Splunk instance you're using:

| Instance Type | URL |
| ------------- | --- |
| Self-hosted | `https://<host>:<port>/services/collector/event` |
| Self-service Splunk Cloud plans | `https://input-<host>:<port>/services/collector/event` |
| Other Splunk Cloud plans | `<protocol>://http-inputs-<host>:<port>/services/collector/event` |

Find more details about configurations in the [Splunk documentation page](https://docs.splunk.com/Documentation).

---

## Configuring the endpoint in Data Stream

Next, follow these steps to configure the new endpoint you created in **Splunk** in your Azion **Data Stream**.

You can find detailed steps for the entire configuration on the [How to use Data Stream guide](/en/documentation/products/guides/use-data-stream/).

:::note
All `key` fields will be masked and an icon that allows revealing the field content will be only displayed to users with the `Edit Data Stream` permission. Users without the `Edit Data Stream` permission can only view the settings of the existing stream but not edit or create new ones.
:::

<Tabs client:visible>
    <Fragment slot="tab.console">Console</Fragment>
    <Fragment slot="tab.rtm">Real-Time Manager</Fragment>

<Fragment slot="panel.console">

In the **Destination** configurations:

1. On the **Connector** dropdown menu, select **Splunk**.
2. On **URL**, add the URL from your Splunk event's connector. If you have an alternative index to point, you can add it at the end of the URL. Example: `https://inputs.splunkcloud.com:8080/services/collector?index=myindex`
3. On **API Key**, add the HTTP Event Collector Token provided in your Splunk installation. Example: `cret248d6-22p8-95gw-g5ke-6k45w2sal634`
4. Make sure the **Active** switch is on.
5. Click the **Save** button.

</Fragment>

<Fragment slot="panel.rtm">

In the **Destination** configurations:

1. On the **Endpoint Type** dropdown menu, select **Splunk**.
2. On **Splunk URL**, add the URL from your Splunk event's connector. If you have an alternative index to point, you can add it at the end of the URL. Example: `https://inputs.splunkcloud.com:8080/services/collector?index=myindex`
3. On **API Key**, add the HTTP Event Collector Token provided in your Splunk installation. Example: `cret248d6-22p8-95gw-g5ke-6k45w2sal634`
4. Make sure the **Active** switch is on.
5. Click the **Save** button.

</Fragment>
</Tabs>

After saving the configurations, your data will be streamed to the newly configured endpoint.

You can keep track of the calls made by Data Stream to Splunk on [Real-Time Events](/en/documentation/products/observe/real-time-events/). To do so, select **Data Source** > **Data Stream** and choose the filters options as you wish.



---

### Trademarks

[Splunk](https://www.splunk.com/) is a registered trademark of Splunk Inc in the United States and other countries.