According to the documentation in the link I provided you need to get an activation key for this to work: Activation Key You require an activation key to use this App. Visit http://www.baboonbones.com/#activation to obtain a non-expiring key Once you have the key you then do the below setup. Setup Untar the release to your $SPLUNK_HOME/etc/apps directory Restart Splunk If you are using a Splunk UI Browse to Settings -- Data Inputs -- REST to add a new Input stanza via the UI If you are not using a Splunk UI (ie: you are running on a Universal Forwarder) , you need to add a stanza to inputs.conf directly as per the specification in README/inputs.conf.spec. The inputs.conf file should be placed in a local directory under an App or User context. Logging Any log entries/errors will get written to $SPLUNK_HOME/var/log/splunk/splunkd.log These are also searchable in Splunk : index=_internal error rest.py You should see a new option under settings/data inputs that is called "REST" and that is where you put the information that you will call out to Symantec Email.cloud service. It should hopefully be fairly straight forward when using the GUI on your Splunk install. ... View more