Splunk
Send a copy of every session message to your Splunk index, and optionally read sessions back from Splunk.
With Splunk connected, every session message is sent to your index as one event. SuperAlign keeps its own copy too, so the console works as before. Optionally, the console can read sessions from Splunk search instead.
Before you begin
- A Splunk HTTP Event Collector (HEC) token with write access to the target index. In Splunk: Settings, Data inputs, HTTP Event Collector, New token.
- The HEC URL, for example
https://http-inputs-yourcompany.splunkcloud.com:443. - For reads: a separate search token and the management URL on port 8089.
Connect
Open the setup window
Extensions, then Splunk under Cloud Extensions, then Configure.
Fill in the required fields
| Field | Notes |
|---|---|
| HEC URL | Where Splunk accepts events |
| HEC token | Secret |
Test and enable
Click Test connection and wait for “Splunk connection works”. Then Save & Enable.
Advanced options
| Field | Default | Change it when |
|---|---|---|
| Index | the token’s default | You want events in a specific index |
| Sourcetype | superalign:promptmessage |
Your Splunk team wants a different label |
| Source | superalign:prompts |
Same |
| Verify TLS certificate | on | Your own Splunk server uses a self-signed certificate |
| Wait for indexer acknowledgement | off | Your HEC token has acknowledgement enabled |
| Events per request | 200 | Splunk Cloud rejects large batches |
| Bytes per request | 1 MB | Same |
| Management URL | empty | You want the console to read from Splunk. Port 8089. Must be set together with the search token |
| Search token | empty | Same. A Splunk auth token with search access, not the HEC token |
Reading from Splunk
With Management URL and Search token set, the console lists sessions and shows transcripts from Splunk search instead of SuperAlign storage. Without them, Splunk is a copy only.
Good to know
- Each message is one event. If a send is retried, Splunk keeps the duplicate. Count on the
message_idfield. - Splunk cannot delete individual events, so retention follows your index settings.
What happens next
Within a minute of the next recorded session, events with sourcetype superalign:promptmessage appear in your index. Search for one message_id to confirm.
Next steps
- Amazon S3 to keep the primary copy in your own bucket
- Review sessions for what the console shows