> ## Documentation Index
> Fetch the complete documentation index at: https://wordsmithai.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Splunk

> Collect the Wordsmith audit log in Splunk with the Wordsmith Add-on for Splunk.

> [!NOTE]
>
> **Preview.** To discuss access to audit streaming for your organisation, contact your Wordsmith account manager.

The Wordsmith Add-on for Splunk (`TA-wordsmith`) collects your organisation's audit log in two ways. Both use the sourcetype `wordsmith:audit`, so searches work the same either way:

* **Polling.** A modular input reads the audit feed on a schedule. It keeps its position in the KV store, so it resumes where it stopped after a restart.
* **Push.** A Wordsmith Splunk HEC destination sends events to your HTTP Event Collector. Install the add-on on your search heads for the field extractions.

The add-on maps sign-ins to the CIM Authentication data model and administrative changes to the Change data model. It also includes example alerts and a **Wordsmith audit log** dashboard.

## Set up polling

1. In Wordsmith, sign in as a user with audit export permission (a dedicated service user is best), go to **Settings** > **API keys**, and create a key with the `audit:read` scope.
2. Download the add-on from **Settings** > **Audit log** > **Streaming**. Install it where your inputs run (a heavy forwarder, or your Splunk Cloud stack) and on your search heads.
3. In the add-on, open **Configuration** > **Account** and add your region and API key.
4. Open **Inputs** and add a **Wordsmith audit feed** input. Choose the account and an index. Leave **Start time** empty to collect the last 24 hours on the first run, or enter an RFC3339 time such as `2026-10-01T00:00:00Z`.
5. Edit the `wordsmith_audit_events` macro so it names your index, for example `index=wordsmith sourcetype="wordsmith:audit"`.

## How the input behaves

* It waits for the `Retry-After` time when Wordsmith rate-limits it.
* If Wordsmith rejects its cursor, the input logs a warning and restarts from the time of the last event it collected.
* If the API key is revoked, or its owner loses audit export permission, the input logs an error in `ta_wordsmith_*.log` and retries on the next run.

## Searching

Delivery is at-least-once, so deduplicate on `event_id`:

```spl theme={null}
`wordsmith_audit_events` wordsmith_action="member.updated" | dedup event_id
```

`action` holds the CIM value (for example `success`, `failure`, `created`, `modified`). The Wordsmith action name, such as `member.updated`, is in `wordsmith_action`. Events name the fields that changed (`changes{}.field`) but never their old or new values.

The example alerts under **Searches, reports, and alerts** ship disabled. Enable the ones you want and tune their thresholds.

## Related pages

* [List Audit Events](https://wordsmithai.mintlify.site/api-reference/audit/list-audit-events.md): the feed the modular input polls, its event fields and its errors.
* [Microsoft Sentinel](https://wordsmithai.mintlify.site/siem/sentinel.md), [Amazon S3 and Security Lake](https://wordsmithai.mintlify.site/siem/aws.md) and [HTTPS receiver](https://wordsmithai.mintlify.site/siem/https.md): the other ways to collect the audit log.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.