How to integrate Salesforce Marketing Cloud with Splunk

[lawrence_magpoc]

As a Splunk SME, I'm tasked to set up the ingestion of Salesforce Marketing Cloud transactional messages into Splunk. We're currently trying to utilize HTTP event collector (HEC) for this but we couldn't get it to work because it's giving us this error:

The Marketing Cloud developer I'm working with told me that in order to resolve the above error, we need to figure out how to "verify callbacks" from our end (Splunk)
https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/verifyCallback.html
I need to know if there's a way to achieve that through HEC or if we need to take an entirely different approach to get the Marketing Cloud events to Splunk.

[lawrence_magpoc · Accepted solution]

I already figured out how to get it to work.

[richgalloway]

Splunk HEC does not do callbacks.  Clients send data over HTTP and Splunk responds with an HTTP status code.  That's it (unless you use ACK, but don't do that).

[lawrence_magpoc]

Ok so I suppose HEC is out of the question then? Is there an alternative solution?

[richgalloway]

There are a few ways to onboard data into Splunk.

1. Install a universal forwarder on the server to send log files to Splunk
2. Have the server send syslog data to Splunk via a syslog server or Splunk Connect for Syslog
3. Use the server's API to extract data for indexing
4. Use Splunk DB Connect to pull data from the server's SQL database.