Drain Audit Logs to Splunk

Audit Log Drains can forward team activity events to Splunk using the HTTP Event Collector (HEC). Use this setup to ingest audit logs into Splunk for security monitoring, compliance review, and search.

The Splunk destination sends events over HTTPS to your HEC endpoint, authenticated with an HEC token. Vercel formats each event using the Splunk HEC event envelope so Splunk indexes the event time and fields correctly. The destination works with both Splunk Cloud and self-hosted Splunk Enterprise collectors.

Follow the steps below to create an HEC token, find your HEC host, and configure the drain. After setup, use Configuration reference for field values and Format for the event envelope.

Pre-requisites:

• A Splunk deployment with the HTTP Event Collector enabled
• An HEC token
• Your Splunk HEC host

1. Enable and create an HEC token

   In Splunk, enable the HTTP Event Collector and create a token. Splunk documents the full process, including index selection, in Set up and use HTTP Event Collector in Splunk Web.

2. Find your HEC host

   Vercel builds the full HEC endpoint from the host you enter. Enter the host that matches your Splunk deployment:

   Deployment	HEC host
   Splunk Cloud on AWS	http-inputs-<host>.splunkcloud.com
   Splunk Cloud on GCP or Azure	http-inputs.<host>.splunkcloud.com
   Self-hosted Splunk Enterprise	<host>:8088

   For the exact host format and prefixes, see Splunk's Set up and use HTTP Event Collector in Splunk Web.

3. Configure the drain in Vercel

   In Vercel, create an Audit Log drain and choose Splunk as the destination. Enter your HEC host and HEC token, then select Test to send an example event. A successful test returns a 2xx response from Splunk. A 403 response means the token is invalid or disabled.

   To verify the host and token outside of Vercel, send a test event to your collector with curl:

   curl "https://your_hec_host_here/services/collector/event" \
     -H "Authorization: Splunk your_hec_token_here" \
     -d '{"sourcetype": "vercel:audit_log", "event": {"message": "test event"}}'

   A reachable collector returns {"text":"Success","code":0}.

Vercel wraps each audit log event in the Splunk HEC event envelope, placing the event time in a time field and the audit log event under event. Vercel tags events with the vercel source and the vercel:audit_log source type, so searches and field extractions have a stable identity to target. To index events under a different source type, override the source type in Splunk as described in Override source types on a per-event basis.

See the Audit Log Drains reference for the schema and an example.

• Audit Log Drains reference
• Configure Drains
• Splunk HTTP Event Collector documentation