topic Re: How to integrate Salesforce Marketing Cloud with Splunk in Splunk Enterprise

How to integrate Salesforce Marketing Cloud with Splunk

lawrence_magpoc — Tue, 19 Dec 2023 07:35:03 GMT

As a Splunk SME, I'm tasked to set up the ingestion of Salesforce Marketing Cloud transactional messages into Splunk. We're currently trying to utilize HTTP event collector (HEC) for this but we couldn't get it to work because it's giving us this error:

The Marketing Cloud developer I'm working with told me that in order to resolve the above error, we need to figure out how to "verify callbacks" from our end (Splunk)
https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/verifyCallback.html
I need to know if there's a way to achieve that through HEC or if we need to take an entirely different approach to get the Marketing Cloud events to Splunk.

Re: How to integrate Salesforce Marketing Cloud with Splunk

richgalloway — Wed, 20 Dec 2023 13:44:12 GMT

Splunk HEC does not do callbacks. Clients send data over HTTP and Splunk responds with an HTTP status code. That's it (unless you use ACK, but don't do that).

Re: How to integrate Salesforce Marketing Cloud with Splunk

lawrence_magpoc — Tue, 26 Dec 2023 09:41:08 GMT

Ok so I suppose HEC is out of the question then? Is there an alternative solution?

Re: How to integrate Salesforce Marketing Cloud with Splunk

richgalloway — Tue, 26 Dec 2023 13:26:38 GMT

There are a few ways to onboard data into Splunk.

Install a universal forwarder on the server to send log files to Splunk
Have the server send syslog data to Splunk via a syslog server or Splunk Connect for Syslog
Use the server's API to extract data for indexing
Use Splunk DB Connect to pull data from the server's SQL database.

Re: How to integrate Salesforce Marketing Cloud with Splunk

lawrence_magpoc — Tue, 13 Feb 2024 14:41:26 GMT

I already figured out how to get it to work.

Re: How to integrate Salesforce Marketing Cloud with Splunk

marcoscala — Wed, 18 Sep 2024 09:29:59 GMT

Hi Lawrence,

can you please share your solution? A customer just asked us to collect audit logs from Marketing Cloud and we're trying to figure how to do it.

Thanks a lot!

Marco

Re: How to integrate Salesforce Marketing Cloud with Splunk

lawrence_magpoc — Thu, 03 Oct 2024 03:11:41 GMT

Hi @marcoscala sorry for the late response. I only saw your comment just now.

Here's how we did it:

Before anything else, make sure that the connection between your Splunk forwarder and SFMC is established and nothing is blocking it. This is were we had our problem initially.
Set up HEC on your Splunk forwarder. Make sure to set the allowQueryStringAuth setting to "true". This will make your HEC act as a webhook. This is important because SMFC only allows you to input endpoint URL and nothing else.
Register your callback URL in SFMC using the HEC endpoint URL and token from step 2. Your callback URL should look something like this:
https://<Your HEC endpoint URL here>:8088/services/collector/event?token=<your HEC token here>
If successful, this will return a callbackid and verification key to be used for the next step.
Manually verify the callback created from step 3. Now I'm not sure if it matters where you do it but just to be sure, execute the command on the server which is running your Splunk forwarder instance.
Create your ENS in SMFC. Granted that everything went well, you should now see the events coming in. I suggest temporarily removing all the filters from your ENS until you've confirmed that you're indeed receiving data from it.

Re: How to integrate Salesforce Marketing Cloud with Splunk

Naresh_sfmc — Tue, 07 Apr 2026 20:19:10 GMT

In step3 , How did you configure in SFMC event call back URL in setup. SFMC doesn't not support ports or query string parameter to be passed during the registration of call back url.

I have whitelisted all the SMFC provided event related IPS with my windows team. But still getting an error 400

Please advise.