---
title: "Splunk Integration with Sensu Server"
slug: "fortanix-dsm-splunk-integration-with-sensu-server"
updated: 2026-03-11T22:37:05Z
published: 2026-03-11T22:37:05Z
canonical: "support.fortanix.com/fortanix-dsm-splunk-integration-with-sensu-server"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Splunk Integration with Sensu Server

## 1.0 Introduction

This article describes the procedure to integrate Splunk with an existing Sensu server.

## 2.0 Configuring Splunk Integration

Perform the following steps in the same order as mentioned to configure Splunk integration with the Sensu server.

### 2.1 List Existing Handlers

Run the following command to list the existing handlers:

```bash
sensuctl handler list
```

![SplunkSensu1.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/splunksensu1.png)

### 2.2 Create a TCP Handler

Run the following command to create a TCP handler to send events to external systems, such as Splunk:

```bash
sensuctl handler create event-storage --type set --handlers splunk_tcp
```

![SplunkSensu2.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/splunksensu2.png)

### 2.3 Edit the TCP Handler Configuration

1. Run the following command to edit the newly created `event-storage` handler:

```bash
sensuctl edit handler event-storage
```

![SplunkSensu4.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/splunksensu4.png)

This will open the configuration file in the default editor.
2. Update the host to `localhost` and port to `7758`.
3. Press `ESC` and then `SHIFT+:WQ!` to save the file.

![SplunkSensu3.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/splunksensu3.png)

### 2.4 Verify Handlers

Run the following command to list the newly created handler:

```bash
sensuctl handler list
```

![SplunkSensu5.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/splunksensu5.png)

### 2.5 List Checks on the Sensu Server

Run the following command to list all the checks on the Sensu server:

```bash
sensuctl check list
```

![SplunkSensu6.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/splunksensu6.png)

You will see all the checks associated with email handlers. For example, `cpu-usage`, `disk-usage` and so on.

Add the newly created `splunk_tcp` handler so that events can also be sent to Splunk.

### 2.6 Add the `splunk_tcp` Handler to Checks

1. Run the following command to edit the check to add `splunk_tcp` handler:

```bash
sensuctl edit check cpu-usage
```
2. Add `splunk_tcp` under `handlers` section.

![SplunkSensu7.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/splunksensu7.png)
3. Save and exit.
4. Repeat this step for all required checks.

### 2.7 Validate Events Locally (Optional)

Run the following command to verify if events are being sent to port `7758` :

```bash
nc -v -l -p 7758
```

If `nc` is not available, install it using:

```bash
yum install nc
```

You should see the JSON event output.

![SplunkSensu8.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/splunksensu8.png)

### 2.8 Install Splunk Forwarder

Run the following command to download and install the Splunk Universal Forwarder on the Sensu server:

```bash
wget -O splunkforwarder-8.2.0-e053ef3c985f-linux-2.6-x86_64.rpm 'https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=linux&version=8.2.0&product=universalforwarder&filename=splunkforwarder-8.2.0-e053ef3c985f-linux-2.6-x86_64.rpm&wget=true'
```

![SplunkSensu9.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/splunksensu9.png)

### 2.9 Configure Splunk Forwarder Input

1. Create a file named `inputs.conf` under `/opt/splunkforwarder/etc/system/local/`.
2. Add the following configuration:

```bash
[tcp://:7758]
index=sensu   [Make sure the index name “sensu” present in Splunk]
```

![SplunkSensu10.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/splunksensu10.png)

### 2.10 Start Splunk Forwarder

Run the following command to start the Splunk forwarder service:

```bash
/opt/splunkforwarder/bin/splunk start --accept-license
```

When prompted, enter the Splunk username and password.

### 2.11 Configure Forwarder Connection

Run the following command to add the Splunk index server as a forwarder:

```bash
/opt/splunkforwarder/bin/splunk add forward-server hostname.domain:7758
```

Replace `<hostname.domain>` with the Splunk index server name or IP address.

For example,

```bash
/opt/splunkforwarder/bin/splunk add forward-server 52.188.83.113:7758
```

![SplunkSensu11.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/splunksensu11.png)

> [!NOTE]
> NOTE
> 
> Ensure that port `7758` is open and configured to receive data.
> 
> 1. Log in to the Splunk console.
> 2. Navigate to **Settings** → **Data** → **Forwarding and receiving**.
> 3. Click **Receiving data** → **Add New**.
> 4. Enter port `7758` and click **Save**.
> 
> ![SplunkSensu12.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/splunksensu12.png)
> 
> **Figure 1: Splunk server**

### 2.12 Test Forwarder Connection

Run the following command to verify the forwarder connection:

```bash
/opt/splunkforwarder/bin/splunk list forward-server
```

![SplunkSensu13.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/splunksensu13.png)

### 2.13 Verify Events in Splunk

1. Log in to the Splunk console.
2. Navigate to the configured index.
3. Verify that Sensu events are being received.

![SplunkSensu14.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/splunksensu14.png)

**Figure 2: Check events in Splunk**

## Related

- [Logging](/fortanix-armor-log-management.md)
- [Data Center Labeling](/fortanix-data-security-manager-data-center-labeling.md)