Integrate Kisi with Splunk

You can integrate Kisi with Splunk to send Kisi events to Splunk (Splunk Cloud Platform or Splunk Enterprise) through the HTTP Event Collector (HEC).

info

This is a Kisi-built integration, maintained and supported by Kisi.

Create the Splunk token

1. Sign in to your Splunk account
2. Navigate to Settings > Data inputs
3. Click on HTTP Event Collector
   • If you see a warning sign beside the Global settings button at the top right corner: Click the Global Settings button > enable the All Token option > Click Save
4. Click on New token
5. Enter the name of the token (e.g. Kisi). Leave the rest of the options with the default values.
6. Click Next
7. In the Input Settings, select your desired index under Select Allowed Indexes
8. Click Review
9. Click Submit
10. Copy the token value. Alternatively, you can view the token value you created by going to Settings > Data Input > HTTP Event Collector

Set up the integration in Kisi

1. Sign in to Kisi with your admin user
2. Click the integrations icon (3x3 grid of dots) > Add Integration
3. Provide a name for your integration (e.g. Splunk)
4. Open the Type dropdown and select Splunk
5. Click on Add
6. In the Splunk Configuration section, under Token, enter the token value you obtained before
7. Under URL, enter the base URL of your HEC endpoint (e.g. https://hec.example.com:8088)
8. Click Save. Kisi sends a test event to confirm the token and URL. If it succeeds, a green Validated check appears.
9. After the configuration is validated, go to Allowed Events, select the events you want to send under Events (or choose All), and click Save
10. Click Save and Return

info

Enter only the scheme, host and port of your HEC endpoint, without /services/collector. Kisi adds /services/collector/event to the URL, so including the path makes requests fail. The HEC port, usually 8088, must be reachable from the internet.

caution

No events are sent to Splunk until you select at least one event type under Allowed Events. Until then, the integration page shows the warning Please select events.

For security, the token isn't shown again after saving. To change the URL or token, enter both values again and click Save.

Check that events arrive in Splunk

When you save the configuration, Kisi sends a test event of type Test Kisi Event with the message Test Kisi Event Message. Search for it in the index you selected for the token to confirm that events are arriving.

Event format

Kisi sends each event to Splunk as a HEC JSON event. Events include fields such as:

• type
• message
• actor_type and actor_name
• object_type and object_name
• place_id
• organization_id
• created_at

Use these fields to search and filter Kisi events. For example, to find unlock events:

index="<your index>" type="lock.unlock"

Remove the integration

1. Sign in to Kisi
2. Click the integrations icon (3x3 grid of dots) and select your Splunk integration
3. Click Delete and confirm

Kisi stops sending events to Splunk. The HEC token in Splunk isn't revoked automatically, so disable or delete it in Splunk under Settings > Data inputs > HTTP Event Collector.

Troubleshooting

Configuration error messages

When you click Save, Kisi may show one of these messages in a Configuration Error dialog:

Error	What to do
Invalid token or URL. Please double-check your credentials and try again.	Splunk rejected the token. Check that the token is enabled, that it's allowed for the selected index, and that All Tokens is enabled in the HEC global settings.
Splunk is currently unavailable. Please try again later.	Splunk returned a server error. Try again later.
Something went wrong. Please double-check your credentials and try again or contact support for assistance.	Check the URL and port, make sure the HEC endpoint is reachable from the internet, and that the URL doesn't include /services/collector. If it persists, contact our support team.

The integration was disabled

If Splunk rejects the token, either when you save or later while Kisi forwards events, Kisi disables the integration and emails your organization administrators. The reason in the email is Your API key is invalid. (on save) or Failed to authenticate with Splunk. Please verify your credentials. (while forwarding). The integration page shows Looks like something went wrong with the url/token you provided. Please reconfigure it.

While the integration is disabled, no events are sent to Splunk. To fix this:

1. In Splunk, create a new token or re-enable the existing one
2. On the Splunk integration page in Kisi, enter the token and URL, then click Save
3. Make sure the integration is enabled again