---
title: "Set Up Scalefusion with Private Splunk using custom add-on"
slug: "send-scalefusion-events-to-splunk-enterprise"
updated: 2026-10-12T07:38:11Z
published: 2026-10-12T07:38:11Z
canonical: "help.scalefusion.com/send-scalefusion-events-to-splunk-enterprise"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.scalefusion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set Up Scalefusion with Private Splunk using custom add-on

This guide explains how to integrate Scalefusion with Splunk Enterprise to collect and monitor Scalefusion events, including Dashboard Access, Account Activity, Device Management, and Device Activity. Using a **custom Splunk add-on**, you can configure event collection at regular intervals and send the data to your Splunk index for monitoring and analysis.

## Before you begin

You will need:

- A Linux machine (Debian-based, e.g. Ubuntu) for Splunk. Setup is easiest on Linux.
- A free Splunk.com account (trial is fine).
- Admin access to your Scalefusion Dashboard.

Keep your credentials somewhere safe: Splunk.com login, Splunk admin username/password (created during install), and your Scalefusion API Key and Secret.

## Step 1: Install Splunk Enterprise

1. Create a trial account at [splunk.com](https://www.splunk.com/) and note your username and password.
2. Download and install Splunk Enterprise from [splunk.com/en_us/download/splunk-enterprise](https://www.splunk.com/en_us/download/splunk-enterprise.html).
3. During setup, set an admin username and password and note them down.
4. Confirm Splunk is working:

- curl -k -u <admin_username>:<admin_password> https://localhost:8089/services/server/info
- You should see server details returned.

Handy Splunk commands

| Action | Command |
| --- | --- |
| Start | /opt/splunk/bin/splunk start |
| Stop | /opt/splunk/bin/splunk stop |
| Restart | /opt/splunk/bin/splunk restart |
| Status | /opt/splunk/bin/splunk status |

## Step 2: Install Splunk Add-on Builder

1. Log in to the Splunk Web UI.
2. In the left Apps panel, click Find more apps.

- ![Click “Find more apps” in the side panel](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/base64-converted-image-1791380482900.jpg)

1. Search for Add-on Builder, then click Install next to *Splunk Add-on Builder* (by Splunk LLC).

- ![Search for Add-on Builder and click Install](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/base64-converted-image-1791380482904.jpg)

1. Enter your Splunk.com username and password when prompted.

- ![Enter your Splunk.com credentials](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/base64-converted-image-1791380482907.jpg)

1. Accept the license and click Agree and Install.

- ![Click “Agree and Install”](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/base64-converted-image-1791380482909.jpg)

1. When you see *Install – Success*, click Done.

- ![Installation success message](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/base64-converted-image-1791380484368.jpg)

## Step 3: Create the Scalefusion add-on

### A. Create the add-on

1. Open Splunk Add-on Builder (Apps list → *Splunk Add-on Builder* → Open App).

- ![Click “Open App”](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/base64-converted-image-1791380484613.jpg)

1. Click New Add-on.

- ![Click “New Add-on”](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/base64-converted-image-1791380484619.jpg)

1. Fill in the details and click Create:

| Field | Value |
| --- | --- |
| Add-on Name | Scalefusion Event Reader |
| Author | Scalefusion Team |
| Folder Name | TA-scalefusion-event-reader (auto-filled) |
| Version | 1.0.0 |
| Description | Read events (Dashboard Access, Account Activity, Device Management, Device Activity) from Scalefusion |

![Create Add-on dialog](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/base64-converted-image-1791380484720.jpg)

1. On the add-on home page, click Configure Data Collection.

![Click “Configure Data Collection” on the add-on home page](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/base64-converted-image-1791380485432.jpg)

### B. Add a data input

1. Click New Input.

- ![Click “New Input”](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/base64-converted-image-1791380485746.jpg)

1. Choose Modular input using my Python code.

- ![Select “Modular input using my Python code”](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/base64-converted-image-1791380486219.jpg)

1. On the Data Input Properties tab, enter:

| Field | Value |
| --- | --- |
| Source type name | scalefusion:event |
| Input display name | Scalefusion Event Reader |
| Input name | scalefusion_event_reader |
| Description | Collects Scalefusion events. |
| Collection interval | 300 (seconds) |

![Data Input Properties](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/base64-converted-image-1791380486286.jpg)

### C. Define the parameters

Data Input Parameters tab

1. Drag a Text field into the middle panel.
2. Set Display label to Cursor and Internal name to cursor.

- ![Drag a Text field to create the Cursor input](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/base64-converted-image-1791380486432.jpg)

Add-on Setup Parameters tab

Drag fields into the panel and set them as follows:

| # | Field type | Display label | Internal name | Required | Default |
| --- | --- | --- | --- | --- | --- |
| 1 | Text | Endpoint URL | endpoint_url | Yes | – |
| 2 | Text | API Key | api_key | Yes | – |
| 3 | Password | API Secret | api_secret | Yes | – |
| 4 | Text | Activity Batch Size | limit | No | 100 |

![Add the Endpoint URL parameter](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/base64-converted-image-1791380486501.jpg)

![Add the API Key parameter](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/base64-converted-image-1791380487196.jpg)

![Add the API Secret parameter (Password type)](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/base64-converted-image-1791380487252.jpg)

![Add the Activity Batch Size parameter (default 100)](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/base64-converted-image-1791380487296.jpg)

### D. Add the Scalefusion script and test

1. Click Next to reach Define & Test.
2. In the Scalefusion Dashboard, go to Integrations → ITSM/SIEM Tools → Configure Splunk.
3. Copy these from the Server Details tab:

- API Key
- API Secret (click the eye icon to reveal)
- Endpoint URL (e.g. https://api.scalefusion.com)

1. Click Download Splunk add-On Python Script. ![](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/image-L4L1YV9A.png)

1. Back in Splunk, open the Add-on Setup Parameters tab and paste in the Endpoint URL, API Key, and API Secret. Leave Activity Batch Size at 100.

- ![Paste your values, replace the code, then click Test and Save](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/base64-converted-image-1791380488189.jpg)

1. In the Code Editor, delete the sample Python code and paste in the downloaded Scalefusion script.
2. Click Test. Check that the output panel shows Done.
3. Click Save, then Finish.

You should see a Done! screen summarising your input.

![The “Done!” summary screen](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/base64-converted-image-1791380488437.jpg)

Skip these: Validate & Package is optional and not required for this setup.

## Step 4: Restart Splunk

Restart so the new add-on loads:

/opt/splunk/bin/splunk restart

After restart, Scalefusion Event Reader appears in the left Apps panel on your Splunk home page.

![Scalefusion Event Reader in the Apps panel](jpg/pg-021-023.jpg){width=6.3in}

## Step 5: Configure the add-on and start collecting

1. Click Scalefusion Event Reader in the left sidebar.
2. Open the Configuration tab and enter your Scalefusion Endpoint URL, API Key, and API Secret, if prompted.
3. Go back to the Inputs tab and click Create New Input.

- ![Click “Create New Input”](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/base64-converted-image-1791380488566.jpg)

1. Fill in:

| Field | Value |
| --- | --- |
| Name | ScalefusionEvents (any unique name) |
| Interval | 300 |
| Index | Your index name (default works) |
| Cursor | Leave blank |

![Add Scalefusion Event Reader input dialog](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/base64-converted-image-1791380488667.jpg)

1. Click Add.
2. Confirm your input appears in the list with status Active.

- ![Input shown as Active](https://cdn.document360.io/175c0eac-012f-4410-bdc5-ac60794f82d8/Images/Documentation/base64-converted-image-1791380489071.jpg)

## Verify it works

1. Open the add-on’s Search tab.
2. Run:

- index=<your_index> sourcetype="scalefusion:event"

1. Events should appear within a few minutes (the input runs every 300 seconds).

## Troubleshooting

| Problem | What to try |
| --- | --- |
| Add-on not in the Apps list | Restart Splunk (Step 4). |
| Test fails in Add-on Builder | Re-copy the API Key, Secret, and Endpoint URL from Scalefusion; check there are no extra spaces. |
| No events in search | Confirm the input is Active, the index name matches your search, and wait at least one interval (5 min). |
| Splunk not responding | Run /opt/splunk/bin/splunk status and start it if stopped. |