topic Re: How can I stream Google Workspace Vault logs into Splunk? in Getting Data In

How can I stream Google Workspace Vault logs into Splunk?

danielbb — Fri, 02 Jan 2026 18:21:35 GMT

I want to add vault logs to my inputs.conf for the Google Workspace TA. I added the following stanza

[activity_report://VaultReport] account = <company> application = vault index = gsuite interval = 300 lookbackOffset = 14400 disabled = 0

But I see the following error coming from the /app/splunk/var/log/splunk/splunk_ta_google_workspace_VaultReport.log -

How can I add vault logs to Splunk?

Re: How can I stream Google Workspace Vault logs into Splunk?

Wander — Fri, 02 Jan 2026 19:35:48 GMT

The line application = vault is the issue. It's not supported as a stanza in the TA. The link below has the supported values.
Configure the Splunk Add-on for Google Workspace - Splunk Add-on for Google Workspace

That being said, what you could do is write a short script that uses the Google API to pull the Vault audit event into a custom input
Vault Audit Activity Events | Admin console | Google for Developers

Re: How can I stream Google Workspace Vault logs into Splunk?

alacercogitatus — Mon, 05 Jan 2026 15:17:46 GMT

While the app that you tagged does not support Vault ingest, checkout https://splunkbase.splunk.com/app/5498 that does have an input for Vault, among others. Thanks!

Re: How can I stream Google Workspace Vault logs into Splunk?

danielbb — Mon, 12 Jan 2026 17:19:56 GMT

Thank you so much @alacercogitatus, I installed it, and Vault data is being streamed in. One thing I don't understand is how do they relate to each other? Should I switch all sourcetypes to https://splunkbase.splunk.com/app/5498 or keep only Vault on this one?