---
title: Splunk Cloud (Legacy)
slug: splunk-cloud-legacy
description: The Splunk Cloud integration (legacy) sends alert data into a Splunk index using an HTTP Event Collector token. The Splunk app is the newer on-premises option.
docTags: 
createdAt: 2023-10-10T20:03:56.128Z
---

# Configuration

### In Flare

In order to configure the integration in Flare, you simply need the netloc or your Splunk instance, the Index under which you want Flare alerts to be indexed under, as well as an API Token you will create in Splunk. We have outlined below the process to get all these in Splunk!

::::WorkflowBlock
:::WorkflowBlockItem
### Go to [Team](https://app.flare.io/#/team)
:::

:::WorkflowBlockItem
### Click on Edit

![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/IznIifEL4NdBZnGbyDqww_team-edit.png)
:::

:::WorkflowBlockItem
### Click on Create a new Alert Channel

![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/-i-_opKVwCPlQRViPacBL_team-create-new-alert-channel.png)
:::

:::WorkflowBlockItem
### Select option Splunk

![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/GhERsFUOyP38C8KTBytzq_screenshot-2023-12-06-at-25720-pm.png)
:::

:::WorkflowBlockItem
### Click on See details 

![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/2835lqlaxlTigG12VuJ8L_screenshot-2023-12-06-at-25734-pm.png)
:::

:::WorkflowBlockItem
### Add the netloc or your Splunk instance, the Index under which you want Flare alerts to be indexed under, as well as an API Token you will create in Splunk.

![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/Whzh-9oefOYfM5r-o7o7R_screenshot-2023-12-06-at-25815-pm.png)
:::
::::

You can also add Labels. These can be useful to filter the data once in Splunk.

### In Splunk

As for the configuration in Splunk, you first need to Add a new Data source in order to create an API Token:

![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/6NNl7T0YECPblf2SUZYLw_screenshot-at-2022-11-10-16-04-12.png)

From there you will need to choose `HTTP Event Collector` as a type of Data source.

You can then click the green button: `New Token` on the top right of the screen. You will get to this: 

![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/JAMAlg45T0IInMuHm_DnY_selectsource.png)

Here you should enter a arbitrary name for the source. Make sure not to check the Enable indexer acknowledgement option. Press Next!

![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/IsMK-d1LRy_HH-iOoQ-9h_inputsetting.png)

This part is important; You choose the Splunk index under which you want Flare data to be indexed. Remember this choice has to then be used in the `Index`  field when configuring in Flare. 

Press Next!

![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/DeBb46ifIFXVyHp5BpCaQ_screenshot-at-2022-11-10-16-07-38.png)

That's it, you now have your API Token that you can use to configure your alert in Flare! 

# Related Articles

:::CtaButton{label="Slack Integration" docId="kpbMB0w-L80be7nunpDrw" openInNewTab="true"}

:::

:::CtaButton{label="Jira Integration" docId="KxvmCnotECpsBlK_YPofr" openInNewTab="true"}

:::