<a id="splunk-sink-connector"></a>

# Splunk Sink Connector for Confluent Platform

The [Splunk Sink connector](https://splunkbase.splunk.com/app/3862/) is used
to move messages from Apache Kafka® to Splunk.

#### IMPORTANT
<!-- WARNING: THIS IS A SHARED FILE AND THE SOURCE IS LOCATED IN DOCS-COMMON. DO NOT ADD TO ANY OTHER REPO. -->

Effective July 6, 2025, only self-managed connector versions that meet or exceed the minimum version listed on the
[Supported Connector Versions](https://docs.confluent.io/platform/7.8/connect/supported-connector-version.html#supported-connector-versions-till-cp-7-8)
page receive support from Confluent. Older, unsupported connector versions have been removed from Confluent Marketplace and
are no longer available for download.

## Features

The Splunk Sink connector includes the following features:

- [At least once delivery](#splunk-sink-at-least-once-delivery)
- [Dead Letter Queue](#splunk-sink-dead-letter-queue)
- [Multiple tasks](#splunk-sink-multiple-tasks)
- [Data ingestion](#splunk-sink-data-digestion)
- [In-flight data transformation and enrichment](#splunk-sink-data-transformation)
- [Acknowledgement mode](#splunk-sink-acknowledgement-mode)

<a id="splunk-sink-at-least-once-delivery"></a>

### At least once delivery

This connector guarantees that records are delivered at least once from the Kafka
topic.

<a id="splunk-sink-dead-letter-queue"></a>

### Dead Letter Queue

This connector supports the Dead Letter Queue (DLQ) functionality. For
information about accessing and using the DLQ, see [Confluent Platform
Dead Letter Queue](/platform/current/connect/concepts.html#dead-letter-queue).

<a id="splunk-sink-multiple-tasks"></a>

### Multiple tasks

The Splunk Sink connector supports running one or more tasks. You can specify
the number of tasks in the `tasks.max` configuration parameter. This can lead
to performance gains when multiple files need to be parsed.

<a id="splunk-sink-data-digestion"></a>

### Data ingestion

The [Splunk HTTP Event Collector (HEC)](https://dev.splunk.com/view/event-collector/SP-CAAAE6M) receives data from
Kafka topics through HTTP or HTTPS connection using an Event Collector token
configured in Splunk. When configuring the connector to consume records from
multiple Kafka topics, the records will be routed to Splunk indexes in the order
you define them in the `splunk.indexes` configuration property. For example,

```text
{
  ...

  "topics":"topic1,topic2,topic3",
  "splunk.indexes": "index1,index2,index3",

  ...
}
```

will result in the following message routing:

```text
topic1 > index1
topic2 > index2
topic3 > index3
```

Alternatively, if you define only one index, all records from multiple topics will
be routed to the same index–anything else will trigger a configuration exception
during initialization.

#### NOTE
This positional mapping requires the static `topics` configuration.
When you use `topics.regex`, the `splunk.indexes`,
`splunk.sources`, and `splunk.sourcetypes` properties are ignored
and events use the HEC token’s default metadata. When you need per-topic
metadata routing, use an explicit `topics` list.

During startup validation, the connector sends an unauthenticated
`GET /services/collector/health` request to each URI configured in
`splunk.hec.uri` to confirm that the Splunk HEC is reachable. This is
standard Splunk HEC behavior. If the Splunk endpoint is behind a proxy or
CDN, such as Amazon CloudFront, that requires authentication on all
paths, this health check fails with an HTTP 401 or 403 error and the
connector does not start. To avoid this, allowlist
`/services/collector/health` so that it can be reached without
authentication in your proxy or CDN configuration.

<a id="splunk-sink-data-transformation"></a>

### In-flight data transformation and enrichment

This feature is used to enrich raw data with extra metadata fields. The
configured enrichment metadata is indexed along with raw event data by the
Splunk software. See [Indexed Field Extractions](https://dev.splunk.com/view/event-collector/SP-CAAAE8Y#indexedfield) for more
information.

#### NOTE
Data enrichment for `/event` HEC endpoint is only available in Splunk
Enterprise 6.5 and above.

<a id="splunk-sink-acknowledgement-mode"></a>

### Acknowledgement mode

This feature implements guaranteed delivery by polling Splunk for
acknowledgement before committing the Kafka offset.

<a id="splunk-sink-connector-install"></a>

## Install the Splunk Sink Connector

You can install this connector by using the [confluent connect
plugin
install](https://docs.confluent.io/confluent-cli/current/command-reference/connect/plugin/confluent_connect_plugin_install.html)
command, or by manually downloading the ZIP file.

### Prerequisites

#### NOTE
- You must install the connector on every machine where Connect will run.
- HEC acknowledgement prevents potential data loss but may slow down event
  ingestion.
- Task configuration parameters vary depending on acknowledgement setting.
  For more details, see the [Configuration Reference for Splunk Sink Connector for Confluent Platform](connector_config.md#splunk-sink-connector-config) page.

- Kafka Broker: Confluent Platform 3.3.0 or later, or Kafka 0.11.0 or later.
- Connect: Confluent Platform 4.0 or later, or Kafka 1.0 or later.
- Java 1.8.
- Splunk 6.5 or later, configured with valid HTTP Event Collector (HEC) tokens.
- Splunk Indexers and Heavy Forwarders that send information to this connector
  should have the same HEC token settings as this connector.
- If the Splunk HEC endpoint is behind a proxy or CDN, such as Amazon
  CloudFront, it must allow unauthenticated `GET` requests to
  `/services/collector/health`. During startup validation, the connector
  calls this endpoint without an HEC token, and a proxy or CDN that requires
  authentication on all paths causes the connector to fail to start with an
  HTTP 401 or 403 error.
- An install of the [Confluent Hub Client](https://docs.confluent.io/home/connect/confluent-hub/client.html). This
  is installed by default with Confluent Enterprise.
- An install of the latest (`latest`) connector version.

  To install the `latest` connector version, navigate to your Confluent Platform
  installation directory and run the following command:
  ```bash
  confluent connect plugin install splunk/kafka-connect-splunk:latest
  ```

  You can install a specific version by replacing `latest` with a version
  number as shown in the following example:
  ```bash
  confluent connect plugin install splunk/kafka-connect-splunk:2.2.0-SNAPSHOT
  ```

### Install the connector manually

[Download and extract the ZIP file](https://www.confluent.io/hub/splunk/kafka-connect-splunk) for your connector
and then follow the manual connector installation
[instructions](/kafka-connectors/self-managed/userguide.html#connect-installing-plugins).

<a id="splunk-sink-connector-license"></a>

## License

The Splunk Sink connector is an open source connector and does not require a
Confluent Enterprise License.

## Configuration Properties

For a complete list of configuration properties for this connector, see
[Configuration Reference for Splunk Sink Connector for Confluent Platform](connector_config.md#splunk-sink-connector-config).

For an example of how to get Kafka Connect connected to [Confluent Cloud](/cloud/current/index.html), see
[Connect Self-Managed Kafka Connect to Confluent Cloud](/cloud/current/cp-component/connect-cloud-config.html#distributed-cluster).

<a id="splunk-connector-quickstart"></a>

## Quick Start

#### IMPORTANT
The default port used by a Splunk HEC is `8088`. However, the ksqlDB
component of Confluent Platform also uses that port. For this quick start, since both
Splunk and Confluent Platform will be running, we configure the HEC to use port `8889`.
If that port is in use by another process, change `8889` to a different,
open port.

1. Start a Splunk Enterprise instance by running the Splunk Docker container.
   ```bash
   docker run -d -p 8000:8000 -p 8889:8889 -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=password" --name splunk splunk/splunk:7.3.0
   ```
2. Open [http://localhost:8000](http://localhost:8000) to access Splunk Web.
   Log in with username `admin` and password `password`.
3. Configure a Splunk HEC using Splunk Web.
   - Click **Settings** > **Data Inputs**.
   - Click **HTTP Event Collector**.
   - Click **Global Settings**.
   - In the All Tokens toggle button, select **Enabled**.
   - Ensure **SSL disabled** is checked.
   - Change the HTTP Port Number to **8889**.
   - Click **Save**.
   - Click **New Token**.
   - In the **Name** field, enter a name for the token: `kafka`
   - Click **Next**.
   - Click **Review**.
   - Click **Submit**.

   #### IMPORTANT
   Note the token value on the **Token has been created successfully** page.
   This token value is needed for the connector configuration later.
4. Install the connector through the [Confluent Hub Client](https://docs.confluent.io/current/connect/managing/confluent-hub/client.html).
   ```bash
   # run from your Confluent Platform installation directory
   confluent connect plugin install splunk/kafka-connect-splunk:latest
   ```
5. Start Confluent Platform.
   ```bash
   confluent local start
   ```
6. [Produce](https://docs.confluent.io/current/cli/command-reference/confluent-produce.html)
   test data to the `splunk-qs` topic in Kafka.
   ```bash
   echo event 1 | confluent local produce splunk-qs
   echo event 2 | confluent local produce splunk-qs
   ```
7. Create a `splunk-sink.properties` file with the properties below.
   Substitute `<HEC_TOKEN>` with the Splunk HEC token created earlier.
   ```properties
   name=SplunkSink
   topics=splunk-qs
   tasks.max=1
   connector.class=com.splunk.kafka.connect.SplunkSinkConnector
   splunk.indexes=main
   splunk.hec.uri=http://localhost:8889
   splunk.hec.token=<HEC_TOKEN>
   splunk.sourcetypes=my_sourcetype
   confluent.topic.bootstrap.servers=localhost:9092
   confluent.topic.replication.factor=1
   value.converter=org.apache.kafka.connect.storage.StringConverter
   ```
8. Start the connector.
   ```bash
   confluent local load splunk --config splunk-sink.properties
   ```
9. In the Splunk user interface, verify that data is flowing into your Splunk
   platform instance by searching using the search parameter
   `source="http:kafka"`.
10. Shut down Confluent Platform.
    ```bash
    confluent local destroy
    ```
11. Shut down the Docker container.
    ```bash
    docker stop splunk
    docker rm splunk
    ```