> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Splunk

> Export filtered Forge security events through Splunk HEC.

Forge delivers normalized `security_event.v1` records to the Splunk HTTP Event
Collector. Export scope, content detail, replay, acknowledgement, and delivery
health are configured per destination.

See [Security Exports](/integrations/security-exports) for shared filtering,
health, multiple-destination, and replay behavior.

## Events

| Category                | Records                                   |
| ----------------------- | ----------------------------------------- |
| `agent_event`           | Agent session and event activity          |
| `governance_signal`     | Policy and governance evaluation evidence |
| `finding`               | Security findings                         |
| `org_audit`             | Organization audit records                |
| `managed_config_audit`  | Managed configuration changes and drift   |
| `agent_attribution`     | Provider-to-agent attribution results     |
| `compliance_assessment` | Compliance evaluation records             |
| `governance_workflow`   | Requests, approvals, and workflow state   |

## HEC config

| Field                   | Description                                               |
| ----------------------- | --------------------------------------------------------- |
| Endpoint URL            | Splunk HEC `/services/collector/event` endpoint           |
| Token                   | HEC token stored as a Forge-managed secret                |
| Index                   | Destination index allowed by the token                    |
| Source and sourcetype   | Stable Splunk routing and field-extraction values         |
| Host                    | Optional HEC host field                                   |
| Indexer acknowledgement | Wait for Splunk acknowledgement before advancing delivery |
| TLS verification        | Certificate verification is enabled by default            |

## Filters

| Filter           | Values                                         |
| ---------------- | ---------------------------------------------- |
| Category         | Any supported event categories                 |
| Minimum severity | `info`, `low`, `medium`, `high`, or `critical` |
| Source           | Source adapter keys                            |
| Product          | Product identity keys or product entity IDs    |
| Identity         | Directory user IDs                             |
| Endpoint         | Device IDs                                     |

## Detail

| Level                 | Payload                                                      |
| --------------------- | ------------------------------------------------------------ |
| `metadata_only`       | Stable IDs, routing, timestamps, category, and severity      |
| `indexed_summary`     | Metadata plus indexed title, summary, and searchable context |
| `full_body_reference` | Reference to retained detail without inlining the body       |
| `full_body_inline`    | Available body fields permitted by export and privacy policy |

Prompt, tool-input, tool-output, and raw-body inclusion can be controlled
independently. The export never manufactures unavailable detail.

## Connection

1. Create an HEC token allowed to write the target index, then enter its event
   endpoint, token, index, source, sourcetype, and host in Forge.
2. Select categories, minimum severity, source/product/identity filters, and
   the detail policy.
3. Send the synthetic test event, verify its indexed fields and acknowledgement
   state in Splunk, then activate the destination.

```spl theme={"system"}
index=forge_security sourcetype=forge:security_event earliest=-15m
| stats count by category severity
```

## Delivery

Forge maintains a cursor per event category and records delivered events,
bytes, skipped events, batch attempts, Splunk acknowledgement IDs, and dead
letters. Replays target an explicit time window and category set without
rewinding the continuous-delivery cursors.