2024.11.2
Home ▸ Integrations ▸

Splunk

The splunk integration makes it possible to log all state changes to an external Splunk database using Splunk’s HTTP Event Collector (HEC) feature. You can either use this alone, or with the Home Assistant for Splunk app. Since the HEC feature is new to Splunk, you will need to use at least version 6.3.

Configuration

To use the splunk integration in your installation, add the following to your configuration.yamlThe configuration.yaml file is the main configuration file for Home Assistant. It lists the integrations to be loaded and their specific configurations. In some cases, the configuration needs to be edited manually directly in the configuration.yaml file. Most integrations can be configured in the UI. [Learn more] file. After changing the configuration.yamlThe configuration.yaml file is the main configuration file for Home Assistant. It lists the integrations to be loaded and their specific configurations. In some cases, the configuration needs to be edited manually directly in the configuration.yaml file. Most integrations can be configured in the UI. [Learn more] file, restart Home Assistant to apply the changes.

# Example configuration.yaml entry
splunk:
  token: YOUR_SPLUNK_TOKEN

Configuration Variables

Looking for your configuration file?
token string Required

The HTTP Event Collector Token already created in your Splunk instance.

host string (Optional, default: localhost)

IP address or host name of your Splunk host, e.g., 192.168.1.10.

port integer (Optional, default: 8088)

Port to use.

ssl boolean (Optional, default: false)

Use HTTPS instead of HTTP to connect.

verify_ssl boolean (Optional, default: false)

Allows you do disable checking of the SSL certificate.

name string (Optional, default: HASS)

This parameter allows you to specify a friendly name to send to Splunk as the host, instead of using the name of the HEC.

filter map (Optional)

Filters for entities to be included/excluded from Splunk. Default is to include all entities. (Configure Filter)

include_domains list (Optional)

Domains to be included.

include_entity_globs list (Optional)

Include all entities matching a listed pattern (e.g., sensor.weather_*).

include_entities list (Optional)

Entities to be included.

exclude_domains list (Optional)

Domains to be excluded.

exclude_entity_globs list (Optional)

Exclude all entities matching a listed pattern (e.g., sensor.weather_*).

exclude_entities list (Optional)

Entities to be excluded.

Configure filter

By default, no entity will be excluded. To limit which entities are being exposed to Splunk, you can use the filter parameter.

# Example filter to include specified domains and exclude specified entities
splunk:
  token: YOUR_SPLUNK_TOKEN
  filter:
    include_domains:
      - alarm_control_panel
      - light
    include_entity_globs:
      - binary_sensor.*_occupancy
    exclude_entities:
      - light.kitchen_light

Filters are applied as follows:

  1. No filter
    • All entities included
  2. Only includes
    • Entity listed in entities include: include
    • Otherwise, entity matches domain include: include
    • Otherwise, entity matches glob include: include
    • Otherwise: exclude
  3. Only excludes
    • Entity listed in exclude: exclude
    • Otherwise, entity matches domain exclude: exclude
    • Otherwise, entity matches glob exclude: exclude
    • Otherwise: include
  4. Domain and/or glob includes (may also have excludes)
    • Entity listed in entities include: include
    • Otherwise, entity listed in entities exclude: exclude
    • Otherwise, entity matches glob include: include
    • Otherwise, entity matches glob exclude: exclude
    • Otherwise, entity matches domain include: include
    • Otherwise: exclude
  5. Domain and/or glob excludes (no domain and/or glob includes)
    • Entity listed in entities include: include
    • Otherwise, entity listed in exclude: exclude
    • Otherwise, entity matches glob exclude: exclude
    • Otherwise, entity matches domain exclude: exclude
    • Otherwise: include
  6. No Domain and/or glob includes or excludes
    • Entity listed in entities include: include
    • Otherwise: exclude

The following characters can be used in entity globs:

* - The asterisk represents zero, one, or multiple characters ? - The question mark represents zero or one character

Related topics