> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/alerts/splunk.md).

# Splunk

Splunk is a software platform to search, analyze, and visualize machine-generated data gathered from websites, applications, sensors, and devices.

Prisma Cloud continually scans your environment for vulnerabilities, Compliance, Runtime behavior, WAAS violations and more. You can now monitor your Prisma Cloud alerts in Splunk using a native integration.

## Send Alerts to Splunk

Follow the instructions below to send alerts from your Prisma Cloud Console to Splunk Enterprise or Splunk Cloud Platform.

### Set Up Splunk HTTP Event Collector (HEC)

Splunk HEC lets you send data and application events to a Splunk deployment over the HTTP and HTTPS protocols. Set up Splunk HEC to view alert notifications from Prisma Cloud in Splunk and consolidate alert notifications from Prisma Cloud into Splunk. This integration enables your operations team to review and take action on the alerts.

1. To set up HEC, use the instructions in [Splunk documentation](https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector). The default **source type** is **\_json**.
2. Go to **Settings > Data inputs > HTTP Event**.
3. Select **Collector** and ensure that HEC is on the list with the **Enabled** the status.

## Message Structure - JSON Schema

The integration with Splunk generates a consistent event format.

The JSON schema includes the following default fields:

* `app`: Prisma Cloud Compute Alert Notification.
* `message`: Contains the alert content in a JSON format as defined in the **Custom JSON** field. For example:
  * `command`: Shows the command which triggered the runtime alert.
  * `namespaces`: Lists the Kubernetes namespaces associated with the running image.
  * `startup process`: Shows the executed process activated when the container is initiated.
* `sender`: Prisma Cloud Compute Alert Notification.
* `sentTs`: Event sending timestamp as Unix time.
* `type`: Shows the message type as `alert`.

```json
{
   app: Prisma Cloud Compute Alert Notification
   message: { [+] }
   sender: Prisma Cloud Compute Alert Notification
   sentTs: 1637843439
   type: alert
}
```

You can learn more about the Alert JSON macros and customizations in the [Webhook Alert documentation](/admin-guide/alerts/webhook.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.prismacloud.io/admin-guide/alerts/splunk.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.