For the complete documentation index, see [llms.txt](https://docs.dropzone.ai/llms.txt). This page is also available as [Markdown](https://docs.dropzone.ai/integrations/data/splunk_data.md).

Splunk is an SIEM integration. SIEM integrations are used to perform analysis of any SIEM generated alerts, and/or to use generated data as part of investigation analysis.

The Dropzone platform integrates with the [Splunk](https://www.splunk.com/en_us/products/enterprise-security-essentials.html) security SIEM. Many customers ingest other alert sources into Splunk (e.g. IDPs) and integrate Dropzone into Splunk rather than the source systems.

Dropzone communicates to Splunk Enterprise using the [Dropzone Connector](https://gitlab.com/dropzone-ai/docs-gitbook/-/blob/main/docs.dropzone.ai/docs/overview/connector.md).

There are two methods to integrate with Dropzone AI: creating a Splunk User or configuring an API token. To create an API token, follow instructions in [Splunk's documentation](https://help.splunk.com/en/splunk-cloud-platform/administer/manage-users-and-security/9.3.2411/authenticate-into-the-splunk-platform-with-tokens/set-up-authentication-with-tokens).

## Create a Splunk User

To create a Splunk user, do the following:

- In the Home Menu of Splunk Enterprise, navigate to Settings > Users

- Click "New User"

- Name the user something memorable, such as Dropzone AI, and create a password. Save them for use later in the Dropzone UI where they are called "Username" and "Password" respectively.

- In the "Assign Roles" section, assign the user the "User" role

You may need to add [capabilities](https://docs.splunk.com/Documentation/Splunk/9.4.2/Security/Rolesandcapabilities) to this role depending on the level of access you want Dropzone to have. If you would like to limit the indexes Dropzone has access to, you will need to create a custom role with inherited permissions from the user role. See the Splunk [documentation](https://docs.splunk.com/Documentation/Splunk/9.4.2/Security/Addandeditroles) for more information on creating custom roles.

- If two-factor authentication is enabled, provide the Duo username.

- Click "Create"

## Enable Splunk

To enable the Data Source integration, you'll need the following information:

| Field      | Source                                    |
|------------|-------------------------------------------|
| Server     | The hostname or IP address of your Splunk server, e.g splunk.corp.example.net |
| Username   | The username of the Splunk user you created earlier |
| Password   | The password of the Splunk user you created earlier |

If you chose to create an API token instead of a Splunk user, you will need to use the API token instead.

To enable the Data Source integration, do the following:

- Navigate to your Dropzone AI tenant home page e.g. https:// _mycompany_.dropzone.app
- In the bottom left hand corner, navigate to Settings > Integrations

- Click "Available"

- In the Search bar, search Splunk, then click "Configure"

- Input your Splunk Server and port

- If you created a Splunk User, under "Authentication Method," select Password. If you created an API token, select Token.

- Input your authentication details

- If you wish for Dropzone to only investigate specific indexes, click "Add Item" in the Index Allow List section. Input the list of Splunk [indexes](https://docs.splunk.com/Documentation/Splunk/9.4.2/Indexer/Aboutindexesandindexers) you want Dropzone to investigate. Otherwise, leave blank.

- Under "Max Concurrent Queries," input the maximum number of [concurrent queries](https://help.splunk.com/en/splunk-cloud-platform/administer/admin-manual/10.1.2507/configure-search-settings-in-splunk-cloud-platform/set-limits-for-concurrent-scheduled-searches) your Splunk deployment can support. If you do not know this number, see [here](https://splunk.my.site.com/customer/s/article/Search-Concurrency-The-maximum-number-of-concurrent-has-been-reached) for more information.

- If you wish to reduce average scan times, check the box labeled "Enable Smart Grouping" to allow Dropzone to automatically group sourcetypes by shared prefixes.

- If you want to further customize Dropzone's query configuration, check the box next to "Enable" in the "Advanced: Query Configuration" section. Then input your desired index selection tips, query tips, query examples, and [macro](https://docs.splunk.com/Documentation/Splunk/9.4.2/Knowledge/Usesearchmacros) configuration.

- Click "Test & Save" to finish.

If you have any errors or questions, engage your Dropzone AI support representative.