---
title: Data Export: Splunk
slug: epmm/system-manager-guide/data-export-splunk
createdAt: 2026-10-06T07:58:36.173Z
---

The following system statistics are forwarded to the Splunk Indexer:

- Ivanti EPMM server: Java Virtual Machine (JVM)
- CPU: including an overview and breakdown by host, process, user, stat, and source.
- Memory: including an overview and breakdown by host, process, user, and source.
- Disk: including usage by host, source, and files opened by command, type, and user.
- Network: including interfaces, interface throughput, connection details, and network sources.

This section includes the general workflow to configure the Splunk Indexer:

| **Step 1** | [Enabling the Splunk Forwarder](docId\:FGmr902GegphcKrXr3K74) to turn on the Splunk Forwarder so it can push data to the Splunk Indexer.                           |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Step 2** | [Adding a Splunk Indexer](docId\:FGmr902GegphcKrXr3K74) to configure which external Splunk Indexer will receive and manipulate the data from the Splunk Forwarder. |
| **Step 3** | [Configuring Splunk Data](docId\:FGmr902GegphcKrXr3K74) to configure which data Splunk Forwarder sends to the Splunk Indexer.                                      |

## Enabling the Splunk Forwarder

**Procedure **

1. Log into System Manager.
2. Go to Settings > Services.
3. Select Enable next to <font color="#323232">Splunk Forwarder</font>.
4. Click Apply > OK to save the changes.

## Adding a Splunk Indexer

**Procedure&#xA0;**

1. Log in to System Manager.
2. Go to **Settings&#x20;**> **Data Export&#x20;**> **Splunk Indexer**.
3. Click **Add&#x20;**&#x74;o open the Add Splunk Indexer window.

::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/kOX7i6OywHvxaOFXM484l_splunkindexermenu.png" position="flex-start" size="100" width="900" height="584" initialPath="../Resources/Images/Splunk_indexer_menu.png" githubPath="System Manager Guide/Resources/Images/Splunk_indexer_menu.png" darkWidth="900" darkHeight="584" showCaption="false" indent="1"}

4. Modify the fields, as necessary. See the following table for descriptions.

Table: Add Splunk Indexer window

| Fields                                     | Description                                                                                                                                                                        |
| ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Splunk Indexer**                         | Add the IP address of your Splunk Enterprise Server.                                                                                                                               |
| <font color="#323232">**Port**</font>      | Add the port number of your Splunk Enterprise Server.                                                                                                                              |
| **Disable SSL**                            | Click to disable Secure Socket Layer (SSL) encrypted communication.                                                                                                                |
| Enable SSL                                 | Click to enable or re-enable SSL encrypted communication.                                                                                                                          |
| **Enable SSL with cert-based mutual auth** | Click to enable or re-enable SSL with certificate-based mutual authentication. Select this option to connect to Splunk Heavy Forwarder for secure mutual authentication to Splunk. |
| Choose file                                | Click **Choose File** and browse to the CA certificate chain. Select it and click **OK**.                                                                                          |

5. Click **Apply&#x20;**> **OK** to save the changes.

## Configuring Splunk Data

**Procedure&#xA0;**

1. Log in to System Manager.
2. Go to **Settings&#x20;**> **Data Export&#x20;**> **Splunk Data.**&#x20;
   The Data to Index window opens.
3. Modify the fields, as necessary. Click **Show/Hide Advanced Options** to further customize which data to send to Splunk.
4. Click **Apply&#x20;**> **OK**.
5. Restart the **Splunk Forwarder** by disabling it, then enabling it again.
   1. Go to **Settings&#x20;**> **Services**.
   2. Select **Disable** **next to Splunk Forwarder**.
   3. Click **Apply&#x20;**> **OK**.
   4. Select **Enable next to Splunk Forwarder**.
6. Click **Apply&#x20;**> **OK&#x20;**&#x74;o save the changes.

## Configuring Splunk certificates

**Procedure&#xA0;**

1. Configure the Splunk client certificate in Ivanti System Manager at **Security&#x20;**> **Certificate Mgmt&#x20;**> **Splunk Client certificate**.
2. Configure the Splunk server certificate in Ivanti System Manager at **Data export**>**&#x20;Splunk indexer page**.