# Integrate with Splunk Enterprise

**Last Updated On**: 24 Jul 2026  
**11 minutes read**

When Endpoint Central is integrated with Splunk, both vulnerability data and audit logs are forwarded to Splunk, giving administrators a consolidated view of detected vulnerabilities and console activity for monitoring, compliance, and security reporting.

## Overview

Splunk's analytics can be used to monitor forwarded events, identify patterns or anomalies, and generate reports and dashboards for auditing, compliance, and security monitoring purposes.

**Note**

- Currently, only Vulnerability data and Action Log Viewer data from Endpoint Central are posted to Splunk.
- Vulnerability data is applicable only for the Endpoint Central server with Security edition or Vulnerability Add-On purchased, and version 11.3.2430.01 and above.
- Action Log Viewer data is applicable for Endpoint Central version 11.4.2533.01 and above.

## Installing the ManageEngine Endpoint Central Add-On in Splunk

1. Navigate to the **Splunk Home** page.
2. In the header menu, click **Apps**.
3. Select **Find More Apps** to be redirected to Splunk's Marketplace.
4. Search for the **ManageEngine Endpoint Central Add-On** app.

![Splunk Apps header menu showing the Find More Apps option](https://www.manageengine.com/sites/meweb/images/desktop-central/help/integration/ec-op-splunk-1.webp)

Splunk Apps menu showing the Find More Apps option.

![Splunk Marketplace search results showing the ManageEngine Endpoint Central Add-On app](https://www.manageengine.com/sites/meweb/images/desktop-central/help/integration/ec-op-splunk-2.webp)

ManageEngine Endpoint Central Add-On in Splunk's Marketplace.

5. Click **Download** and enter your username and password.
6. Click **Agree and Install**. The application will now be accessible from the Splunk home page or the Apps menu.

## Creating a CA-Bundle (Certificate Authority Bundle) for SSL Validation

1. Navigate to the Endpoint Central server installation directory and go to **%EC Home Dir% → nginx → conf**.
2. Open the **server.crt** file with a text editor and copy the contents of the certificate file.

![Endpoint Central nginx conf directory showing the server.crt file location](https://www.manageengine.com/sites/meweb/images/desktop-central/help/integration/ec-op-splunk-3.webp)

Endpoint Central nginx/conf directory showing the server.crt file.

![server.crt file open in a text editor with certificate contents ready to copy](https://www.manageengine.com/sites/meweb/images/desktop-central/help/integration/ec-op-splunk-4.webp)

server.crt file open in a text editor — copy all contents.

3. Navigate to the Splunk installation directory and go to **%Splunk Home Dir% → etc → apps → TA-manageengine-endpoint-central-add-on**.

![Splunk directory structure showing the TA-manageengine-endpoint-central-add-on folder path](https://www.manageengine.com/sites/meweb/images/desktop-central/help/integration/ec-op-splunk-5.webp)

Splunk directory path to the TA-manageengine-endpoint-central-add-on folder.

4. Within the **TA-manageengine-endpoint-central-add-on** folder, create a new folder named **certificates**.

![New certificates folder created inside the TA-manageengine-endpoint-central-add-on directory](https://www.manageengine.com/sites/meweb/images/desktop-central/help/integration/ec-op-splunk-6.webp)

New certificates folder created inside the add-on directory.

5. Inside the **certificates** folder, create a new text file and rename it to **ec.ca-bundle**.

![New text file being created inside the certificates folder](https://www.manageengine.com/sites/meweb/images/desktop-central/help/integration/ec-op-splunk-7.webp)

Creating a new file inside the certificates folder.

![File renamed to ec.ca-bundle inside the certificates folder](https://www.manageengine.com/sites/meweb/images/desktop-central/help/integration/ec-op-splunk-8.webp)

File renamed to ec.ca-bundle inside the certificates folder.

6. Open **ec.ca-bundle** with a text editor, paste the contents of the **server.crt** file copied from Endpoint Central, and save the file.

![ec.ca-bundle file open in a text editor with server.crt contents pasted](https://www.manageengine.com/sites/meweb/images/desktop-central/help/integration/ec-op-splunk-9.webp)

ec.ca-bundle file with server.crt contents pasted — ensure the file is saved with the CA-BUNDLE file type.

## Generating an API Key in Endpoint Central

1. In the Endpoint Central console, navigate to **Admin → API Key Management** and click **Generate Key**.

![API Key Management page in Endpoint Central showing the Generate Key button](https://www.manageengine.com/sites/meweb/images/desktop-central/help/integration/ec-op-splunk-10.webp)

API Key Management page in Endpoint Central.

2. Select **Splunk** from the Application menu and click **Generate Key**.

![Generate Key dialog with Splunk selected from the Application dropdown](https://www.manageengine.com/sites/meweb/images/desktop-central/help/integration/ec-op-splunk-11.webp)

Generate Key dialog with Splunk selected as the application.

3. Copy your API key.

![Generated API key displayed with a copy option](https://www.manageengine.com/sites/meweb/images/desktop-central/help/integration/ec-op-splunk-12.webp)

Generated API key ready to be copied.

**Warning**

The generated key will be shown **only once**. Copy the API key when it is displayed and store it in a secure place. If lost, it cannot be retrieved — only a new key can be regenerated.

## Configuring the App in Splunk for Endpoint Central

1. Navigate to the Splunk home page, click **Apps** in the header menu, and select the **ManageEngine Endpoint Central Add-On** app.
2. Within the app, navigate to the **Configurations** page and click the **Add** button.

![Splunk Configurations page showing the Add button for adding a new Endpoint Central configuration](https://www.manageengine.com/sites/meweb/images/desktop-central/help/integration/ec-op-splunk-13.webp)

Configurations page in the Splunk add-on showing the Add button.

3. In the pop-up, choose **Endpoint Central On-premise** from the **Deployment Type** and complete all required fields.
4. Paste the API key copied from Endpoint Central.
5. Click **Add**. If all information is correct, the configuration will be validated successfully.

Valid inputs for the configuration:

- **Account Name:** Must be unique and without spaces.
- **Deployment Type:** Must be Endpoint Central On-premise.
- **Server URL:** URL with the scheme **https://**. This URL must be accessible from the machine hosting Splunk. If using a proxy, configure proxy settings before adding configuration details.
- **API Key:** Use the API key generated from Endpoint Central without any modifications.
- **Select Inputs:** Select the required log inputs based on your needs. These can also be configured or modified later from the Inputs Configuration section.

![Splunk configuration form showing Account Name, Deployment Type, Server URL, API Key, and Select Inputs fields](https://www.manageengine.com/sites/meweb/images/desktop-central/help/integration/ec-op-splunk-14.webp)

Splunk configuration form showing all required input fields.

The added configuration will appear in the **Accounts** section.

![Splunk Accounts section showing the newly added Endpoint Central configuration entry](https://www.manageengine.com/sites/meweb/images/desktop-central/help/integration/ec-op-splunk-15.webp)

Accounts section showing the newly added Endpoint Central configuration.

## Creating an Input with the Endpoint Central Configuration

1. Navigate to the **Inputs** tab in Splunk, click **Create New Input**, and select the log data you need from Endpoint Central.

![Splunk Inputs tab showing the Create New Input button with log type selection options](https://www.manageengine.com/sites/meweb/images/desktop-central/help/integration/ec-op-splunk-16.webp)

Splunk Inputs tab showing the Create New Input option.

2. In the pop-up window, enter all required information. From the **Global Account** dropdown, select the account configured for Endpoint Central.
3. Click **Add**. If all inputs are valid, the input will be added successfully.

Valid inputs:

- **Name:** Unique name without any white spaces.
- **Interval:** Must be in seconds.
  - For Vulnerability data: Between 3600 seconds (1 hour) and 86400 seconds (24 hours).
  - For Action Log Viewer data: Between 300 seconds (5 minutes) and 86400 seconds (24 hours).
- **Index:** Default.
- **Global Account:** Account created for Endpoint Central in the configuration section.

![Splunk Create Input form showing Name, Interval, Index, and Global Account fields](https://www.manageengine.com/sites/meweb/images/desktop-central/help/integration/ec-op-splunk-17.webp)

Create Input form showing all required fields including Global Account selection.

## Viewing Data in Splunk

1. Once an input is configured, synchronization with the Endpoint Central server will begin.
2. Navigate to the **Search** tab in the app.

![Splunk Search tab in the ManageEngine Endpoint Central Add-On app](https://www.manageengine.com/sites/meweb/images/desktop-central/help/integration/ec-op-cloud-splunk-search-1.webp)

Search tab in the ManageEngine Endpoint Central Add-On app.

3. Click **Data Summary** and navigate to the **Sourcetypes** tab.

![Splunk Data Summary showing the Sourcetypes tab with available data sources](https://www.manageengine.com/sites/meweb/images/desktop-central/help/integration/ec-op-cloud-splunk-search-2.webp)

Splunk Data Summary showing the Sourcetypes tab.

4. Search for the required sourcetype and click on it to view the data:

- Vulnerability data sourcetype: `manageengine:ec:vulnerability`
- Action Log Viewer data sourcetype: `manageengine:ec:actionlogdata`

![Splunk search results showing vulnerability and action log data sourcetypes from Endpoint Central](https://www.manageengine.com/sites/meweb/images/desktop-central/help/integration/ec-op-cloud-splunk-search-3.webp)

Splunk search results showing Endpoint Central vulnerability and action log data.

## Initiating Full Sync

1. Navigate to **%Splunk Home Dir% → etc → apps → TA-manageengine-endpoint-central-add-on → default**.
2. Create a file named **custom.conf**.

![Splunk default directory showing the custom.conf file created for initiating full sync](https://www.manageengine.com/sites/meweb/images/desktop-central/help/integration/ec-op-splunk-18.webp)

custom.conf file created in the Splunk add-on default directory.

3. Add the following entry to the file:

```ini
[manageengine:ec:vulnerability]
initiate_full_sync = True
```

4. Save the file to trigger the full sync. During the next sync, a full sync will be initiated.

## Configuring Multiple Endpoint Central Servers in Splunk

1. Whenever you add a new On-Premises Endpoint Central server in Splunk, include the contents of its **server.crt** file in the existing **ec.ca-bundle** file.
2. Refer to the steps in [Creating a CA-Bundle for SSL Validation](https://www.manageengine.com/products/desktop-central/help/integration/integrate-with-splunk.html#creating-a-ca-bundle-for-ssl-validation) to copy the contents of the **server.crt** file.
3. Append the copied contents to the end of the already created **ec.ca-bundle** file.
4. Follow the instructions in [Configuring the App in Splunk for Endpoint Central](https://www.manageengine.com/products/desktop-central/help/integration/integrate-with-splunk.html#configuring-the-app-in-splunk-for-endpoint-central) to complete the configuration.

## Related

- [Integrate with PAM360](https://www.manageengine.com/products/desktop-central/help/integration/integrate-with-pam360.html)
- [All Integrations](https://www.manageengine.com/products/desktop-central/integration.html)
- [Vulnerability Management Overview](https://www.manageengine.com/products/desktop-central/help/vulnerability-management/vulnerability-management-overview.html)