# Sending Sensu Metrics to Splunk

**URL:** <https://discourse.sensu.io/t/sending-sensu-metrics-to-splunk/2535>\
**Category:** Sensu Go\
**Created:** [April 12, 2021, 5:58pm UTC](https://discourse.sensu.io/t/sending-sensu-metrics-to-splunk/2535 "2021-04-12T17:58:26Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![username123](https://avatars.discourse-cdn.com/v4/letter/u/7ba0ec/32.png) [@username123](https://discourse.sensu.io/u/username123)\
**Post date:** [April 12, 2021, 5:58pm UTC](https://discourse.sensu.io/t/sending-sensu-metrics-to-splunk/2535/1 "2021-04-12T17:58:26Z")

</div>

Is there any way to send sensu metrics over to splunk?

---

<div class="post-metadata">

**Author:** ![calebhailey](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/calebhailey/32/46_2.png) [@calebhailey](https://discourse.sensu.io/u/calebhailey)\
**Post date:** [April 12, 2021, 6:51pm UTC](https://discourse.sensu.io/t/sending-sensu-metrics-to-splunk/2535/2 "2021-04-12T18:51:21Z")

</div>

Here’s an example using a Sensu socket handler and the Splunk Universal Forwarder:

> <https://github.com/sensu/catalog/blob/main/pipelines/event-storage/splunk_tcp.yaml>

This template assumes the Splunk Universal Forwarder is installed on all Sensu backend nodes, and simply forwards Sensu formatted events to Splunk (unless you’re also using a mutator to modify event payloads).

---

<div class="post-metadata">

**Author:** ![username123](https://avatars.discourse-cdn.com/v4/letter/u/7ba0ec/32.png) [@username123](https://discourse.sensu.io/u/username123)\
**Post date:** [April 13, 2021, 4:41pm UTC](https://discourse.sensu.io/t/sending-sensu-metrics-to-splunk/2535/3 "2021-04-13T16:41:09Z")

</div>

I can’t seem to get it working. I have attached a screenshot of my sensu handler as well as my splunk input.conf file. The host on the sensu handler is not actually 123.123.123.123, I just put that so that I do not reveal my actual host. However the host I actually used is the ip address of the first sensu backend node in my cluster where I also have the input.conf configured for.

 ![test_handler](https://us1.discourse-cdn.com/flex016/uploads/sensu/original/1X/c86785eb3419185b74439f28d4e91077c4202fa5.png)

---

<div class="post-metadata">

**Author:** ![username123](https://avatars.discourse-cdn.com/v4/letter/u/7ba0ec/32.png) [@username123](https://discourse.sensu.io/u/username123)\
**Post date:** [April 13, 2021, 4:41pm UTC](https://discourse.sensu.io/t/sending-sensu-metrics-to-splunk/2535/4 "2021-04-13T16:41:42Z")

</div>

![test_splunk_inputs](https://us1.discourse-cdn.com/flex016/uploads/sensu/original/1X/08f3246a0c311c7c1e53bccc3907abae5bf9583b.png)

---

<div class="post-metadata">

**Author:** ![username123](https://avatars.discourse-cdn.com/v4/letter/u/7ba0ec/32.png) [@username123](https://discourse.sensu.io/u/username123)\
**Post date:** [April 13, 2021, 4:43pm UTC](https://discourse.sensu.io/t/sending-sensu-metrics-to-splunk/2535/5 "2021-04-13T16:43:57Z")

</div>

What I am expecting to see is some recognizable output in the Splunk Search with the sourcetype of “sensu”. Is that right to assume or should I be expecting to see the metrics in a different way?

---

<div class="post-metadata">

**Author:** ![gkiran.ch](https://avatars.discourse-cdn.com/v4/letter/g/3bc359/32.png) [@gkiran.ch](https://discourse.sensu.io/u/gkiran.ch)\
**Post date:** [May 28, 2021, 11:29am UTC](https://discourse.sensu.io/t/sending-sensu-metrics-to-splunk/2535/6 "2021-05-28T11:29:15Z")

</div>

@username123 were you able to get your setup working with splunk. If so, can you provide the steps you have followed