> For the complete documentation index, see [llms.txt](https://docs.vectra.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vectra.ai/configuration/response/siem/splunk-siem-vectra-integration-guide-start-here-for-rux.md).
# Splunk On-Prem SIEM / Vectra integration guide (start here for RUX)
As stated in the summary, this article only applies to customers using Vectra's Respond UX. If you are using the Quadrant UX please see the [Splunk Integration Guide for Vectra AI.](/configuration/response/siem/splunk-siem-vectra-integration-guide-start-here-for-qux.md) If you are unsure of which UX you are using, please see [Vectra Analyst User Experiences (Respond vs Quadrant)](/deployment/getting-started/analyst-ux-options-rux-vs-qux.md).
## Integration Overview
Vectra AI provides Add-ons and Apps to seamlessly integrate with Splunk and Splunk Enterprise Security. Vectra provides 2 main data sources for Splunk:
#### **Detection Data and Entity Scoring from Vectra XDR**
* Vectra XDR uses a patent-pending combination of data science, machine learning and behavioral analysis to reveal the fundamental characteristics of malicious threat behavior. The Vectra platform captures packets and logs across public cloud, SaaS, federated identity and data center networks to surface and prioritize threats. These high-fidelity insights can be pulled via API to integrate seamlessly with your workflows and operations.
#### **Network Metadata from Vectra Stream**
* Leveraging the same platform, Vectra provides the ability to export network metadata collected by the Vectra Sensors deployed through the environment to Splunk. This data provides an in-depth view of any communication observed in your environment and enables you to perform investigation & threat hunting. A list of protocols supported, and attributes extracted is available [here](https://support.vectra.ai/s/article/KB-VS-1245).
### Vectra XDR Add-On and Apps for Splunk
#### Vectra XDR
| Name | Type | Supported Splunk Version | CIM Compatibility | Splunk Cloud | Data Structure |
| ---------------------------- | ------ | ------------------------- | ----------------- | ------------ | -------------- |
| Vectra XDR Technology Add-on | Add-on | 10.1, 10.0, 9.4, 9.3, 9.2 | Yes | Yes | JSON |
| Vectra XDR App | App | 10.1, 10.0, 9.4, 9.3, 9.2 | n/a | Yes | n/a |
#### Vectra Stream
| Name | Type | Supported Splunk Version | CIM Compatibility | Splunk Cloud | Data structure | Dependencies |
| ------------------------------------------ | ------ | ----------------------------------------------------- | ----------------- | ------------ | -------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| Technology Add-on for Vectra Stream (JSON) | Add-on | 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1 | Yes | Yes | JSON | N/A |
| Vectra Stream | App | 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1, 9.0 | n/a | Yes | n/a |
|
### Prerequisites
* Valid Splunk account to be able to access & download apps in [Splunkbase](https://splunkbase.splunk.com/).
* Supported version of Splunk or Splunk Enterprise.
* Applications dependencies listed in the Add-ons and apps table must be fulfilled.
* **Create index(es)**.
* Vectra recommends to have a dedicated index for Vectra XDR and another dedicated index if also using Vectra Stream.
## Integration of Splunk with Vectra XDR
There are 3 main steps required to integrate Splunk with Vectra XDR:
1. Creating API clients in the Vectra Respond UX to be used by the Technology Add-on (TA).
2. Installation and configuration of "Vectra XDR Technology Add-on".
* The Vectra XDR Technology Add-on for Splunk pulls entity scoring data, detection data, audit data, lockdown data and health data from the Vectra platform, does CIM mapping on detection and audit data and maps the entity scoring, detection data fields to corresponding Vectra Syslog event fields.
* If you have any prior version of a Vectra TA for use with an existing Quadrant UX based deployment of Vectra, you can keep that as a separate deployment but both the TA and App for Vectra XDR using the Respond UX must be installed separately. You cannot upgrade from a prior version to this version.
3. Installation of "Vectra XDR App".
* The Vectra XDR App for Splunk builds a dashboard from data provided by Vectra XDR Technology Add-on for Splunk.
### 1. Creating API Clients for Splunk Integration
Before configuring the Splunk integration, create separate API clients for each endpoint required by the integration.
Creating individual API clients for each endpoint is required to ensure that the Splunk integration can securely and efficiently collect data from Vectra.
#### Why Separate API Clients Are Required
Separate API clients are required for the following reasons:
* Each endpoint used by the Splunk integration is polled individually.
* Different endpoints require different permission levels in Vectra.
* Using separate API clients helps improve performance and scalability when accessing multiple API endpoints.
* Troubleshooting is easier because each API client is associated with a specific endpoint and purpose.
* Access can be managed more securely by assigning only the required permissions to each API client.
#### API Clients Required for the Integration
Create the following API clients for use with the Vectra Splunk integration.
| API Client Name | Role | Purpose |
| -------------------------- | --------- | ----------------------------------------------------- |
| `ro_splunk_entity_scoring` | Read-only | Used by Splunk to poll the `entity_scoring` endpoint. |
| `ro_splunk_detections` | Read-only | Used by Splunk to poll the `detections` endpoint. |
| `ro_splunk_lockdown` | Read-only | Used by Splunk to poll the `lockdown` endpoint. |
| `audit_splunk_audits` | Auditor | Used by Splunk to poll the `audits` endpoint. |
| `audit_splunk_health` | Auditor | Used by Splunk to poll the `health` endpoint. |
#### Recommended Naming Convention
Use clear and descriptive API client names so that each client can be easily identified during configuration and troubleshooting.
The recommended naming format is:
```
_splunk_
```
For example:
```
ro_splunk_detections
```
This name indicates that the API client is read-only, used for Splunk, and associated with the detections endpoint.
#### Permission Guidance
Assign only the permissions required for each endpoint.
* Use a **Read-only** role for endpoints that only require read access.
* Use an **Auditor** role for endpoints that require audit-level access.
* Avoid using overly permissive roles unless specifically required.
This helps maintain least-privilege access for the Splunk integration.
#### Creating API Clients
To create each of the API clients listed above:
* Log in to your Vectra Respond UX, navigate to *Manage > API Clients*, and click "Add API Client".
* Enter a name for the client you are creating, select the role, optionally enter a description and then click "Generate Credentials".
* On the "API Client Created" screen, copy the Client ID and Secret Key to a safe place for later configuration in Splunk and then click "Done".
* !! Please note that this is the only time you can copy the secret key. If you do not copy the key now, you will need to delete your API client and start over creating that client.
* When you have created all 5 required API clients, you screen should look similar to this:
#### After Creating the API Clients
After all required API clients are created:
1. Save the client credentials securely.
2. Confirm that each API client has the correct role assigned.
3. Use these API clients when configuring accounts in the Vectra XDR Technology Add-on for Splunk.
4. Create one account configuration for each API client in the add-on.
Once the API clients are created, continue with the add-on configuration steps in Splunk.
***
### 2. Installation and Configuration of "Vectra XDR Technology Add-on"
#### Installation of the Vectra XDR Technology Add-on for Splunk
This section explains how to install the **Vectra XDR Technology Add-on for Splunk**.
The add-on can be installed using one of the following methods:
1. **Recommended:** Install the add-on from **Find More Apps** in Splunk Web.
2. **Alternative:** Install the add-on from a downloaded file using Splunk Web.
3. **Manual Installation:** Install the add-on directly from the Splunk server file system.
Use the installation methods in the order listed above. The **Find More Apps** method is recommended because it allows the add-on to be installed directly from Splunk Web with minimal manual steps.
#### Recommended Installation Order
Install the add-on using the following order of preference:
| Priority | Installation Method | When to Use |
| -------- | ---------------------------------------- | ----------------------------------------------------------------- |
| 1 | Install from **Find More Apps** | Recommended method for most Splunk environments |
| 2 | Install from a file using **Splunk Web** | Use when you have already downloaded the add-on package |
| 3 | Manual installation from the file system | Use when Splunk Web installation is not available or not suitable |
#### Method 1: Install the Add-on from Find More Apps
This is the recommended method for installing the **Vectra XDR Technology Add-on for Splunk**.
Use this method if the add-on is available from the **Find More Apps** section in Splunk Web.
#### Steps
1. Log in to Splunk Web using an administrator account.
2. From the Splunk home dashboard, go to the **Apps** section.
3. Click **Find More Apps**.
4. In the search bar, search for:
**Vectra XDR Technology Add-on**
5. Select the **Vectra XDR Technology Add-on** from the search results.
6. Click **Install**.
7. Follow the on-screen instructions to complete the installation.
8. If Splunk prompts you to restart, restart the Splunk instance.
9. After the restart is complete, log back in to Splunk Web.
10. Navigate to:
**Apps > Manage Apps**
11. Search for the **Vectra XDR Technology Add-on** and confirm that it is installed and enabled.
#### Method 2: Install the Add-on from a File Using Splunk Web
Use this method if the add-on package has already been downloaded and you want to upload it through Splunk Web.
#### Steps
1. Download the **Vectra XDR Technology Add-on** package from Splunk.
2. Log in to Splunk Web using an administrator account.
3. From the Splunk home page, navigate to:
**Apps > Manage Apps**
4. In the upper-right corner of the page, click:
**Install app from file**
5. Click **Choose File**.
6. Browse to the location where the **Vectra XDR Technology Add-on** installation file is saved.
7. Select the add-on installation file.
8. Click **Upload**.
9. Follow the on-screen prompts to complete the installation.
10. If Splunk prompts you to restart, restart the Splunk instance.
11. After the restart is complete, verify that the add-on is installed by navigating to:
**Apps > Manage Apps**
12. Search for the **Vectra XDR Technology Add-on** and confirm that it appears in the installed apps list.
#### Method 3: Manually Install the Add-on from the File System
Use this method only when installation through Splunk Web is not available or when your environment requires manual deployment.
Manual installation requires access to the Splunk server file system.
#### Steps
1. Download the **Vectra XDR Technology Add-on** package.
2. Log in to the Splunk server.
3. Locate the downloaded add-on package.
4. Extract the downloaded package directly into the Splunk apps directory:
```bash
$SPLUNK_HOME/etc/apps/
```
5. Confirm that the extracted add-on folder is available under:
```bash
$SPLUNK_HOME/etc/apps/
```
6. Ensure that the Splunk user has the correct ownership and permissions for the add-on directory.
7. Restart Splunk to load the newly installed add-on:
```bash
$SPLUNK_HOME/bin/splunk restart
```
8. After Splunk restarts, log in to Splunk Web.
9. Navigate to:
**Apps > Manage Apps**
10. Search for the **Vectra XDR Technology Add-on** and confirm that it is installed and enabled.
#### Verify the Installation
After completing any of the installation methods, verify that the add-on was installed successfully.
#### Steps
1. Log in to Splunk Web.
2. Navigate to:
**Apps > Manage Apps**
3. Search for:
**Vectra XDR Technology Add-on**
4. Confirm that the add-on appears in the list of installed apps.
5. Verify that the add-on status is **Enabled**.
6. If the add-on does not appear, restart Splunk and check again.
***
### Configuration of the Add-on
After installing the **Vectra XDR Technology Add-on**, configure the required accounts, proxy settings, and logging level before creating data inputs.
The add-on configuration includes the following sections:
* **Account**: Used to configure API client credentials.
* **Proxy**: Used when Splunk must connect through a proxy server.
* **Logging**: Used to define the logging level for troubleshooting and operational visibility.
***
#### Configure Accounts
Create an account for each API client that was configured earlier.
#### Steps
1. Log in to Splunk Web.
2. Navigate to:
**Vectra XDR Technology Add-on > Configuration > Account**
3. Click **Add** or **Add Account**.
4. Enter the required account details for the API client.
5. Save the account configuration.
6. Repeat these steps for each API client that needs to be used with the add-on.
After the accounts are configured, the **Account** table should display the configured accounts.
**Example Account Configuration:**
***
#### Configure Proxy Settings
If your Splunk environment requires a proxy to connect to external services, configure the proxy settings in the add-on.
Skip this section if your Splunk environment does not use a proxy.
#### Steps
1. Navigate to:
**Vectra XDR Technology Add-on > Configuration > Proxy**
2. Enable proxy configuration if required.
3. Enter the required proxy details, such as:
* Proxy host
* Proxy port
* Proxy username, if authentication is required
* Proxy password, if authentication is required
4. Save the proxy configuration.
**Example Proxy Configuration:**
#### Configure Logging Level
The logging level controls the amount of detail written to the add-on logs.
#### Steps
1. Navigate to:
***Vectra XDR Technology Add-on > Configuration > Logging***
2. Select the desired logging level.
3. Save the configuration.
If you are unsure which logging level to use, Vectra recommends selecting:
```
Info
```
The **Info** logging level provides a balanced amount of operational detail and is suitable for most environments.
#### Recommended Logging Level
| Logging Level | When to Use |
| ------------- | ------------------------------------------------- |
| **Info** | Recommended for normal operation. |
| **Debug** | Use temporarily when troubleshooting an issue. |
| **Error** | Use when you only want to capture error messages. |
> **Note:** Debug logging can generate more log data. Use it only when troubleshooting and change the logging level back to **Info** after the issue is resolved.
#### Verify the Add-on Configuration
After completing the configuration:
1. Confirm that all required accounts are listed under the **Account** tab.
2. Confirm that proxy settings are configured only if required by your Splunk environment.
3. Confirm that the logging level is set to **Info**, unless a different level is needed.
4. Continue to the data input configuration section.
***
### Configuration of Data Inputs
After configuring the required account, create data inputs to collect data from the selected Vectra endpoints.
Create a separate data input for each account and endpoint that you want to ingest into Splunk. Each input should be configured with the correct name, interval, index, status, and account.
#### Add a New Data Input
1. Log in to Splunk Web.
2. Navigate to the **Vectra XDR Technology Add-on**.
3. Go to the **Inputs** section.
4. Click **Create New Input** or **Add Input**, depending on the option available in your Splunk interface.
5. Configure the required fields for the data input.
#### Data Input Configuration Fields
Use the following guidance when configuring each data input.
| Field | Description | Recommended Value |
| ------------------- | ------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- |
| **Name** | Enter a unique name for the data input. The name should clearly relate to the account or endpoint being configured. | Use a descriptive name, such as `detections_account1` or `health_account1`. |
| **Interval** | Defines how often Splunk collects data from the configured endpoint. The value is entered in seconds. | `60` seconds is recommended for most inputs. |
| **Index** | Select the Splunk index where the collected data should be stored. | Use the index created for this add-on. |
| **Historical Data** | Optional setting that allows the input to collect data from the previous 24 hours when enabled. | Enable only if you want to backfill recent data. |
| **Status** | Determines whether the input is active. | Set to **Enabled** to start data collection. |
| **Account** | Select the account that was configured earlier. | Choose the appropriate account from the available list. |
#### Recommended Input Interval
For most data inputs, an interval of **60 seconds** is recommended.
This means Splunk checks the configured endpoint every 60 seconds and collects any available data.
#### Health Input Interval
For the **Health** input, use an interval of:
```
900 seconds
```
The Health input should use a longer interval because health data is refreshed every **15 minutes** on the Vectra side. Setting the interval to 900 seconds helps avoid unnecessary polling and aligns the Splunk collection interval with the data refresh cycle.
#### Historical Data Option
The **Historical Data** option is optional.
When enabled, the input collects data from the previous **24 hours**. This can be useful in smaller environments where you want to quickly verify that the add-on is working and confirm that data is being ingested into Splunk.
Use this option when you want immediate visibility into recent data after creating the input.
#### Important Notes
* The **Historical Data** option is not available for the **Health** input.
* The **Historical Data** option is not available for the **Lockdown** input.
* Enabling historical data may increase the amount of data ingested during the first collection cycle.
#### Recommended Configuration
Use the following recommendations when creating data inputs:
| Input Type | Recommended Interval | Historical Data Supported | Notes |
| ---------- | -------------------: | ------------------------- | -------------------------------------------------------------------------------------- |
| Detections | 60 seconds | Yes | Enable historical data if you want to collect the previous 24 hours of detection data. |
| Entities | 60 seconds | Yes | Use the index created for the add-on. |
| Audits | 60 seconds | Yes | Useful for collecting audit activity. |
| Health | 900 seconds | No | Health data is refreshed every 15 minutes on the Vectra side. |
| Lockdown | 60 seconds | No | Historical data is not available for Lockdown. |
#### Verify Data Input Configuration
After creating the data inputs:
1. Confirm that each required input appears in the Inputs table.
2. Verify that the **Status** is set to **Enabled**.
3. Confirm that each input is associated with the correct **Account**.
4. Confirm that the correct Splunk **Index** is selected.
5. Allow the configured interval to pass, then verify that data is being ingested into Splunk.
You can verify data ingestion by searching the configured index in Splunk Search.
***
### Uninstall and Clean Up Steps
Use the following steps to uninstall the **Vectra XDR Technology Add-on for Splunk** and remove related log files from the Splunk instance.
> **Note:** Before removing files, ensure that you have the required permissions on the Splunk server. If needed, take a backup of the add-on configuration before uninstalling.
#### Remove the Add-on Directory
Remove the add-on directory from the Splunk apps folder:
```bash
$SPLUNK_HOME/etc/apps/TA-Vectra-XDR
```
This removes the installed add-on files from the Splunk instance.
#### Remove Add-on Log Files
Remove the log files generated by the add-on from the Splunk log directory:
```bash
$SPLUNK_HOME/var/log/Splunk/ta_vectra_xdr_*.log
```
These log files are created by the add-on during configuration, data collection, and troubleshooting activities.
#### Restart Splunk
After removing the add-on directory and related log files, restart the Splunk Enterprise instance.
Restarting Splunk ensures that the cleanup changes are reflected in the Splunk Web UI.
```bash
$SPLUNK_HOME/bin/splunk restart
```
After the restart is complete, verify that the add-on no longer appears under:
```
Apps > Manage Apps
```
***
### Troubleshooting
This section provides basic troubleshooting steps for the **Vectra XDR Technology Add-on for Splunk**.
Use these checks if the add-on is not working as expected, data is not being collected, or logs need to be reviewed.
#### General Checks
To troubleshoot the add-on, review the add-on log files located in the Splunk log directory:
```bash
$SPLUNK_HOME/var/log/Splunk/
```
All log files generated by this add-on are stored in this directory and use the following naming pattern:
```bash
ta_vectra_xdr*.log
```
You can also review the logs directly from Splunk Web using the following search query:
```spl
index="_internal" source=*ta_vectra_xdr*.log
```
This query displays all log messages generated by the add-on.
To view only error messages, use the following query:
```spl
index="_internal" source=*ta_vectra_xdr*.log ERROR
```
Review the error messages to identify configuration issues, authentication failures, connectivity problems, or data collection errors.
#### Add-on Icons Are Not Showing
The add-on does not require a Splunk restart immediately after installation for its core functionality to work.
However, the add-on icons may not appear in Splunk Web until Splunk is restarted once after installation.
If the icons are not visible:
1. Restart the Splunk Enterprise instance.
```bash
$SPLUNK_HOME/bin/splunk restart
```
2. Log back in to Splunk Web.
3. Navigate to the Apps menu and verify that the add-on icons are displayed.
#### Data Collection Issues
If data collection is not working, verify the following:
1. Confirm that the Splunk server has internet connectivity.
2. If your environment uses a proxy, confirm that the proxy is enabled and configured correctly in the add-on.
3. Confirm that the configured account credentials are correct.
4. Verify that the data inputs are enabled.
5. Confirm that the selected index exists and is searchable.
6. Review the relevant input log files for error messages.
#### Input-Specific Log Files
Each data input writes logs to a specific log file. Use the log file that matches the input type you are troubleshooting.
| Input Type | Log File |
| -------------- | ----------------------------------------------------- |
| Entity Scoring | `ta_vectra_xdr_entity_scoring_input_.log` |
| Detections | `ta_vectra_xdr_detections_input_.log` |
| Audits | `ta_vectra_xdr_audits_input_.log` |
| Lockdown | `ta_vectra_xdr_lockdown_input_.log` |
| Health | `ta_vectra_xdr_health_input_.log` |
Replace `` with the name of the data input configured in Splunk.
#### Example Troubleshooting Searches
Use the following Splunk searches to review add-on activity.
#### View All Add-on Logs
```spl
index="_internal" source=*ta_vectra_xdr*.log
```
#### View Add-on Errors
```spl
index="_internal" source=*ta_vectra_xdr*.log ERROR
```
#### View Logs for a Specific Input
```spl
index="_internal" source=*ta_vectra_xdr**.log
```
Replace `` with the name of the input you want to troubleshoot.
#### Recommended Troubleshooting Flow
Use the following order when troubleshooting data collection issues:
1. Confirm that the data input is enabled.
2. Confirm that the account configuration is correct.
3. Confirm that the index is configured correctly.
4. Check network connectivity from the Splunk server.
5. Verify proxy configuration, if a proxy is required.
6. Review the add-on logs in:
```bash
$SPLUNK_HOME/var/log/Splunk/
```
7. Search the `_internal` index for add-on errors.
8. Resolve any errors found in the logs and restart Splunk if required.
***
### 3. Installation of Vectra XDR App for Splunk
This section explains how to install, configure, troubleshoot, and uninstall the **Vectra XDR App for Splunk**.
The Vectra XDR App provides dashboards and visualizations for data collected by the **Vectra XDR Technology Add-on for Splunk**. Before using the app, ensure that the add-on is installed, configured, and collecting data successfully.
#### Installation
The **Vectra XDR App for Splunk** can be installed using one of the following methods:
1. **Recommended:** Install the app from **Find More Apps** in Splunk Web.
2. **Alternative:** Install the app from a downloaded file using Splunk Web.
#### Method 1: Install from Find More Apps
Use this method if the app is available directly from Splunk Web.
#### Steps
1. Log in to Splunk Web using an administrator account.
2. From the Splunk Home dashboard, go to the **Apps** section.
3. Click **Find More Apps**.
4. Search for:
**Vectra XDR App for Splunk**
5. Select the app from the search results.
6. Click **Install**.
7. Follow the on-screen instructions to complete the installation.
8. Restart Splunk if prompted.
9. After installation, verify that the app is available from the Splunk Apps menu.
#### Method 2: Install from a File Using Splunk Web
Use this method if you have already downloaded the app package.
#### Steps
1. Download the **Vectra XDR App for Splunk** package from Splunk.
2. Log in to Splunk Web using an administrator account.
3. Navigate to:
**Apps > Manage Apps**
4. In the upper-right corner, click:
**Install app from file**
5. Click **Choose File**.
6. Select the downloaded **Vectra XDR App** package.
7. Click **Upload**.
8. Follow the on-screen prompts to complete the installation.
9. Restart Splunk if prompted.
10. After installation, confirm that the app appears in the Splunk Apps menu.
#### Configuration
No additional configuration is required if the data collected by the add-on is stored in the default Splunk index:
```
main
```
However, if you configured the data inputs to send data to an index other than `main`, you must update the app macro so that the dashboards search the correct index.
***
### Update the Index Macro
Update the index macro only if your data is stored in a custom index.
#### Steps
1. Log in to Splunk Web.
2. Navigate to:
***Settings > Advanced search > Search macros***
3. In the **App context** drop-down, select:
**Vectra XDR App for Splunk**
4. Locate and open the following macro:
```
vectra_xdr_index_macro
```
5. Update the macro definition to use the index configured for the Vectra XDR Technology Add-on.
Example:
```spl
index=
```
6. Click **Save**.
7. Open the Vectra XDR App dashboards and confirm that data is displayed.
#### Configuration Example
If your Vectra data is stored in an index named `vectra_index`, update the macro definition as follows:
```spl
index=vectra_index
```
This ensures that the app dashboards search the correct index instead of the default `main` index.
***
### Troubleshooting
Use this section if dashboards are not displaying data or if you need to verify that Vectra data is available in Splunk.
#### Verify Data in the Configured Index
To confirm that data is being collected, run a search using the index configured for the add-on.
Example:
```spl
index= sourcetype IN ("vectralockdown", "vectraaudits", "vectradetections", "vectraentity:scoring", "vectrahealth")
```
Replace `` with the index used in your data input configuration.
***
#### Search by Individual Sourcetype
You can also search each sourcetype individually.
#### Lockdown Events
```spl
index= sourcetype="vectralockdown"
```
#### Audit Events
```spl
index= sourcetype="vectraaudits"
```
#### Detection Events
```spl
index= sourcetype="vectradetections"
```
#### Entity Scoring Events
```spl
index= sourcetype="vectraentity:scoring"
```
#### Health Events
```spl
index= sourcetype="vectrahealth"
```
#### Review Add-on Logs
The Vectra XDR App uses data collected by the Vectra XDR Technology Add-on. If data is not available, review the add-on logs.
The add-on log files are located in:
```bash
$SPLUNK_HOME/var/log/splunk/
```
Check log files that match the following pattern:
```bash
ta_vectra_xdr_*.log
```
You can also search the logs from Splunk Web:
```spl
index="_internal" source=*ta_vectra_xdr*.log
```
To view only error messages, use:
```spl
index="_internal" source=*ta_vectra_xdr*.log ERROR
```
#### Dashboard Is Not Populating
If the Vectra XDR App dashboards are not displaying data, verify the following:
1. Confirm that the Vectra XDR Technology Add-on is installed and collecting data.
2. Confirm that the data inputs are enabled.
3. Confirm that data exists in the configured index.
4. Confirm that the expected sourcetypes are available in Splunk.
5. If you are using a custom index, confirm that the `vectra_xdr_index_macro` macro is updated correctly.
6. Refresh the dashboard after updating the macro.
7. If required, restart Splunk and check the dashboard again.
***
### Uninstall and Clean Up Steps
Use the following steps to uninstall the **Vectra XDR App for Splunk**.
> **Note:** Removing the app does not remove the data already indexed in Splunk. It only removes the app files, dashboards, and related app components.
#### Remove the App Directory
Remove the app directory from the Splunk apps folder:
```bash
$SPLUNK_HOME/etc/apps/Vectra-XDR-App
```
#### Restart Splunk
After removing the app directory, restart the Splunk Enterprise instance so that the cleanup changes are reflected in Splunk Web.
```bash
$SPLUNK_HOME/bin/splunk restart
```
#### Verify Uninstallation
After Splunk restarts:
1. Log in to Splunk Web.
2. Navigate to:
**Apps > Manage Apps**
3. Confirm that **Vectra XDR App for Splunk** no longer appears in the installed apps list.
## Integration of Splunk with Vectra Stream
There are 3 main steps required to integrate Splunk with Vectra Stream:
1. Installation and configuration of "[Technology Add-on for Vectra Stream (JSON)](https://splunkbase.splunk.com/app/6367) ".
2. Installation of "[Vectra Stream](https://splunkbase.splunk.com/app/4739) " App.
3. Configuring Vectra Stream to send metadata to Splunk using Publisher of "Raw JSON" using Protocol of "TCP" to the server IP/Hostname and port number of your choice where Splunk will be listening.
For details please see the [Splunk Integration Guide for Vectra AI](/deployment/stream/publisher-specific-guidance/splunk-integration.md) .
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.vectra.ai/configuration/response/siem/splunk-siem-vectra-integration-guide-start-here-for-rux.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.