how to connect Azure Event Grid to Splunk using Webhooks and Cloud Events

[LymanHurd]

I am the technical lead for a product that we hope to integrate to Splunk instances using webhooks.  As an intermediary step we use Azure Event Grid and communicate events via the Cloud Events standard protocol.  To set up webhooks requires a handshake described here: https://learn.microsoft.com/en-us/azure/event-grid/end-point-validation-cloud-events-schema (the page is from Microsoft but the handshake protocol is actually defined by the Cloud Events consortium),

What I need to know is whether Splunk can accept connections out of the box or whether it requires an intermediary plug-in.  We are aware that Splunk requires an authorization header with each message.

[livehybrid]

Hi @LymanHurd 

Out of the box Splunk does not support receiving Cloud Events in this way, however you might be able to look at using the Splunk HTTP Event Collector (HEC) which as you said does rely on an authorization token, however you can enable "allowQueryStringAuth" which allows passing the HEC token as a GET/Query Param - would this help? You would need to consider any security implications too.

Alternatively you could create a custom REST endpoint within a custom Splunk app that could handle this and pass the ingested data into Splunk.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing