---
title: Splunk
description: Send a copy of every session message to your Splunk index, and optionally read sessions back from Splunk.
---

With Splunk connected, every session message is sent to your index as one event. SuperAlign keeps its own copy too, so the console works as before. Optionally, the console can read sessions from Splunk search instead.

## Before you begin

- A Splunk **HTTP Event Collector (HEC) token** with write access to the target index. In Splunk: Settings, Data inputs, HTTP Event Collector, New token.
- The **HEC URL**, for example `https://http-inputs-yourcompany.splunkcloud.com:443`.
- For reads: a separate **search token** and the management URL on port 8089.

## Connect

1. **Open the setup window**

    **Extensions**, then **Splunk** under Cloud Extensions, then **Configure**.

2. **Fill in the required fields**

    | Field | Notes |
    | --- | --- |
    | **HEC URL** | Where Splunk accepts events |
    | **HEC token** | Secret |

3. **Test and enable**

    Click **Test connection** and wait for "Splunk connection works". Then **Save & Enable**.

## Advanced options

| Field | Default | Change it when |
| --- | --- | --- |
| **Index** | the token's default | You want events in a specific index |
| **Sourcetype** | `superalign:promptmessage` | Your Splunk team wants a different label |
| **Source** | `superalign:prompts` | Same |
| **Verify TLS certificate** | on | Your own Splunk server uses a self-signed certificate |
| **Wait for indexer acknowledgement** | off | Your HEC token has acknowledgement enabled |
| **Events per request** | 200 | Splunk Cloud rejects large batches |
| **Bytes per request** | 1 MB | Same |
| **Management URL** | empty | You want the console to read from Splunk. Port 8089. Must be set together with the search token |
| **Search token** | empty | Same. A Splunk auth token with search access, not the HEC token |

## Reading from Splunk

With **Management URL** and **Search token** set, the console lists sessions and shows transcripts from Splunk search instead of SuperAlign storage. Without them, Splunk is a copy only.

## Good to know

- Each message is one event. If a send is retried, Splunk keeps the duplicate. Count on the `message_id` field.
- Splunk cannot delete individual events, so retention follows your index settings.

## What happens next

Within a minute of the next recorded session, events with sourcetype `superalign:promptmessage` appear in your index. Search for one `message_id` to confirm.

## Next steps

- [Amazon S3](/surface/extensions/cloud/s3) to keep the primary copy in your own bucket
- [Review sessions](/surface/sessions/review) for what the console shows