---
title: Splunk
summary: Fastly will POST messages to your Splunk account in the format specified in the Splunk object.
url: https://www.fastly.com/documentation/reference/api/logging/splunk
---

Fastly will POST messages to your Splunk account in the format specified in the Splunk object.

## Data model

| Field | Type | Description |
|-------|------|-------------|
| `token` | string | A Splunk token for use in posting logs over HTTP to your collector. |
| `url` | string | The URL to post logs to. |
| `use_tls` | string | Whether to use TLS. |
| `format` | string | A Fastly <a href="https://www.fastly.com/documentation/guides/integrations/streaming-logs/custom-log-formats/">log format string</a>. |
| `format_version` | integer | The version of the custom logging format used for the configured endpoint. The logging call gets placed by default in <code>vcl_log</code> if <code>format_version</code> is set to <code>2</code> and in <code>vcl_deliver</code> if <code>format_version</code> is set to <code>1</code>. |
| `log_processing_region` | string | The geographic region where the logs will be processed before streaming. Valid values are <code>us</code>, <code>eu</code>, and <code>none</code> for global. |
| `name` | string | The name for the real-time logging configuration. |
| `placement` | string | Where in the generated VCL the logging call should be placed. If not set, endpoints with <code>format_version</code> of 2 are placed in <code>vcl_log</code> and those with <code>format_version</code> of 1 are placed in <code>vcl_deliver</code>. |
| `request_max_bytes` | integer | The maximum number of bytes sent in one request. Defaults <code>0</code> for unbounded. |
| `request_max_entries` | integer | The maximum number of logs sent in one request. Defaults <code>0</code> for unbounded. |
| `response_condition` | string | The name of an existing condition in the configured endpoint, or leave blank to always execute. |
| `tls_ca_cert` | string | A secure certificate to authenticate a server with. Must be in PEM format. |
| `tls_client_cert` | string | The client certificate used to make authenticated requests. Must be in PEM format. |
| `tls_client_key` | string | The client private key used to make authenticated requests. Must be in PEM format. |
| `tls_hostname` | string | The hostname to verify the server's certificate. This should be one of the Subject Alternative Name (SAN) fields for the certificate. Common Names (CN) are not supported. |
| `created_at` | string | Date and time in ISO 8601 format. (Read-only) |
| `deleted_at` | string | Date and time in ISO 8601 format. (Read-only) |
| `service_id` | string | Alphanumeric string identifying the service. (Read-only) |
| `updated_at` | string | Date and time in ISO 8601 format. (Read-only) |
| `version` | string | String identifying a service version. (Read-only) |

## API endpoints

### List Splunk log endpoints

**GET** `/service/{service_id}/version/{version_id}/logging/splunk`

List all of the Splunk logging objects for a particular service and version.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `service_id` | string | path | Yes | Alphanumeric string identifying the service. |
| `version_id` | integer | path | Yes | Integer identifying a service version. |

### Create a Splunk log endpoint

**POST** `/service/{service_id}/version/{version_id}/logging/splunk`

Create a Splunk logging object for a particular service and version.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `service_id` | string | path | Yes | Alphanumeric string identifying the service. |
| `version_id` | integer | path | Yes | Integer identifying a service version. |

### Get a Splunk log endpoint

**GET** `/service/{service_id}/version/{version_id}/logging/splunk/{logging_splunk_name}`

Get the details for a Splunk logging object for a particular service and version.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `logging_splunk_name` | string | path | Yes | The name for the real-time logging configuration. |
| `service_id` | string | path | Yes | Alphanumeric string identifying the service. |
| `version_id` | integer | path | Yes | Integer identifying a service version. |

### Update a Splunk log endpoint

**PUT** `/service/{service_id}/version/{version_id}/logging/splunk/{logging_splunk_name}`

Update the Splunk logging object for a particular service and version.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `logging_splunk_name` | string | path | Yes | The name for the real-time logging configuration. |
| `service_id` | string | path | Yes | Alphanumeric string identifying the service. |
| `version_id` | integer | path | Yes | Integer identifying a service version. |

### Delete a Splunk log endpoint

**DELETE** `/service/{service_id}/version/{version_id}/logging/splunk/{logging_splunk_name}`

Delete the Splunk logging object for a particular service and version.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `logging_splunk_name` | string | path | Yes | The name for the real-time logging configuration. |
| `service_id` | string | path | Yes | Alphanumeric string identifying the service. |
| `version_id` | integer | path | Yes | Integer identifying a service version. |