Splunk

Works with: Splunk Cloud Platform, Splunk Enterprise, and HEC-compatible inputs (CrowdStrike Falcon LogScale, Cribl Stream, OpenObserve).

Status: verified

Tested end to end against Splunk Enterprise: batches, the test event, OCSF and a rejected token.

1. Create a HEC token

1. In Splunk: Settings → Data inputs → HTTP Event Collector → New Token.
2. Name it SafeHanded. Leave Enable indexer acknowledgement off.
3. Source type: leave automatic (SafeHanded sends safehanded:audit), or create one.
4. Choose the index the events should land in, then Review → Submit and copy the token value.
5. Splunk Enterprise only: make sure HEC is enabled under Global Settings, with SSL on, and reachable from the internet over HTTPS.

2. Connect in SafeHanded

Settings → Integrations → Connect → Splunk:

Field	Value
HEC URL	Splunk Cloud: https://http-inputs-<stack>.splunkcloud.com. Splunk Enterprise: https://splunk.example.com:8088. SafeHanded adds /services/collector/event when the URL has no path.
HEC token	The token value.
Index	Optional. Blank uses the token’s default index.
Source type	Optional. Defaults to safehanded:audit.
Format	SafeHanded JSON or OCSF.

Save, open the destination again and press Send test event.

3. Search

index=<your index> sourcetype="safehanded:audit"
| table _time event actor_label request_id ip seq

Each event’s time is the time it happened in SafeHanded, and the host and source are safehanded.

Troubleshooting

• Splunk said: Invalid token (code 4): the token is wrong or disabled.
• Incorrect index (code 7): the token isn’t allowed to write to that index. Add it to the token’s allowed indexes, or leave Index blank.
• Could not reach the destination: check the URL and port, and that HEC is reachable from the internet over HTTPS with a valid certificate.