Track team activity for your professional plan with Splunk

Splunk integration is available for Arrow Business or Omnix plans.

With our Splunk integration, you can track how your team members use Arrow. When you turn on Splunk integration for your team, we send your Activity Logs automatically to Splunk.

Splunk is a security information and event management (SIEM) tool that allows you to monitor team activity in real time. You can search and filter events like added devices, login sharing, and invitations to your Arrow plan. You can also set up alerts for specific events, like when someone shares a login across teams or with someone outside the organization.

Set up Splunk integration for your team

1. Log in to your Splunk Enterprise account.
2. Create an HTTP Event Collector in Splunk
3. Open the Admin Console in Arrow. Select Integrations and then Events Reporting.
4. Enter your Splunk instance URL. Generally, your instance URL will be either:

   https://{your_domain}:8088/services/collector/event/1.0

   or, for Splunk Cloud:

   https://{your_domain}.splunkcloud.com:8088/services/collector/event/1.0

   Splunk documentation

5. Enter the HTTP Event Collector token in the field Splunk instance Token.
6. Select Save tokens. If you already have a token saved, you can modify the token or URL and select Update tokens.
7. Turn on Activate Splunk Integrations. Events in your Activity Log will appear in Splunk after five minutes.

   Tip: If you see an error message that says “server busy” when using Splunk, clear the Use Deployment Server checkbox in your Splunk Enterprise settings.
   More about HTTP event collector settings

After setting up your integration, you can use Splunk to track the events listed in the Activity Log in your Arrow Admin Console.

Note: Your Splunk integration won't log any previous events. Only new events will be tracked after the setup.

Use Activity Logs to track team activity

Important: If you've completed the integration and still can't see events from your Activity Log in Splunk, add the following IP addresses to your allow list in Splunk Web: 34.240.215.133/32, 34.253.34.91/32, 52.210.105.173/32.
Configure IP allow lists using Splunk Web

For more information on tracking events in Splunk, check out Splunk’s documentation website.

Splunk documentation

If you have any issues with this process, please contact our Support team.

Contact an agent through the Admin Console
Chat with our bot