Banner background image
Last updated Feb 23, 2024

Sending Data to Splunk


In this topic you can learn how to use the insights real-time data export feature to send data to Splunk and use it there.


Note: Configure real-time data export before configuring Splunk reporting.

Configure Splunk Integration With Event Hubs

Configure Splunk Add-on for Microsoft Cloud Services Integration With Azure Event Hub.

The following table lists the components used for consuming Event Hubs data.




A reader from a data source (e.g., EventHub added by the Microsoft Data Services add-on.


Storage of data from the inputs that can be queried.

Search and Reporting

Data exploration from ad-hoc queries to persistent dashboards

Create Event Index

You need to create an event index to integrate with Event Hubs.

Note: Consider using default values unless you want specific index settings.

Set up Azure Connection

To authenticate Splunk with Azure, you need to create an Azure AD application and a service principal.

  1. Sign in to
  2. Register an application with Azure AD and create a service principal.
  3. Connect to Splunk Add-on for Microsoft Cloud Services using the Client ID / Tenant ID (Directory (tenant) ID in Azure). Alternatively, you can use Client secret.

Add Data Through Splunk Web

Define input and ingest data into the index.

Add data input using Splunk Web and configure the following settings:

  • The Azure Event Hub Namespace (FQDN)
  • The Azure Event Hub Name
  • The Azure Event Hub Consume Group

    Note: Use More options to set the preferred index defined in Create event index.

Explore Data

To explore the dataset you can start sampling available data.

Refine the data by filtering and grouping (e.g., see recent count of events for jobs).

Was this page helpful?

Get The Help You Need
Learning RPA - Automation Courses
UiPath Community Forum
Uipath Logo White
Trust and Security
© 2005-2024 UiPath. All rights reserved.