Integrate Audit Trail with Splunk

Reviewed on August 05, 2026

Audit Trail supports sending event data to Splunk Enterprise and Splunk Cloud Platform for security monitoring, data visualization and analytics, and compliance reporting.

By centralizing Scaleway audit data within Splunk, security operations center (SOC) and cloud operations teams can address several operational and security use cases:

• User activity monitoring and access governance
• Change tracking and configuration management
• Compliance auditing and reporting (SOC 2, ISO 27001)
• Security incident investigation and forensics
• Anomaly detection and threat hunting
• Operational troubleshooting and root cause analysis

This guide explains how to integrate Scaleway Audit Trail with Splunk.

The integration consists of two components, both installable and configurable via Splunk:

• Scaleway Add‑on for Splunk – Collects Audit Trail events from your Scaleway infrastructure and forwards them securely to Splunk Enterprise/Cloud.
• Scaleway App for Splunk – Visualizes the ingested events with ready‑made dashboards and security analytics; you can also build custom dashboards.

Scaleway Add-on for Splunk

The Scaleway Add-on for Splunk acts as a data collection layer that ingests audit logs from Scaleway infrastructure into a Splunk deployment. It connects to Scaleway accounts via API credentials, allowing administrators to collect:

• audit events from the Scaleway Audit Trail service
• Identity and Access Management (IAM) logs covering users, groups, and applications
• event data about Compute resources

After the Splunk platform indexes the ingested information, the data can be analyzed directly or correlated with other data sources to provide enriched contextual insights.

To ensure compatibility across the Splunk ecosystem, the add-on extracts fields aligned with the Common Information Model (CIM). This standardized mapping allows the collected data to feed directly into Splunk Enterprise Security (ES), Splunk IT Service Intelligence (ITSI), or custom correlation searches and dashboards.

Before you start

To complete the actions presented below, you must have:

• A Scaleway account logged in to the console
• Owner status or IAM permissions allowing you to perform actions in the intended Organization
• API credentials (Access Key ID and Secret Key) with Audit Trail (and optionally IAM and Instance) read permissions. For details, see Configure an API key and permissions.
• Opened port 443 to allow the Scaleway Add-on to communicate with the Scaleway servers
• Splunk Enterprise or Splunk Cloud Platform (supported versions: 9.4.x, 10.0.x, 10.2.x, 10.4.x)
• The Splunk admin role assigned to you

Install the add-on

You can install the Scaleway Add-on via Splunk Web or the command line. The add-on is supported across all Splunk Enterprise and Splunk Cloud instance types, including indexers, search heads, and forwarders.

1. Download the Scaleway Add-on from Splunkbase.
2. Determine the best installation location and method for your deployment architecture.
3. Complete any required prerequisite steps.
4. Execute the installation.

For detailed instructions about how to install the add-on in a single-instance deployment, a distributed deployment, or Splunk Cloud, see the relevant sections in the Installing add-ons Splunk documentation:

• Single-instance Splunk Enterprise
• Distributed Splunk Enterprise
• Splunk Cloud

For distributed environments, the next section provides additional information.

Installation in distributed environments

The following table provides guidance on where and how to install the add-on within distributed Splunk Enterprise environments or setups that rely on forwarders.

Note that based on your infrastructure, deployment preferences, and the specific requirements of the add-on, deployment across multiple Splunk instances may be necessary.

The following table provides a quick reference for the compatibility of the add-on with Splunk distributed deployment features.

Configure an API key and permissions

To start collecting data from the Scaleway Audit Trail, IAM, and Compute APIs using the add-on, you must generate an API key in the Scaleway console and assign the appropriate permissions.

1. Go to the Scaleway console.
2. Create a dedicated IAM application.
3. Create an API key.
4. When creating an API key, make a note of the following information. They will be needed later, when configuring an account in Splunk.
   • Secret Key
   • Organization ID
5. Create a new IAM policy and attach that policy to the Scaleway application you have just created.
6. Within the policy configuration, add the necessary rules to grant read-only access by defining the exact scope and permission sets. Since these services operate at different hierarchical levels, you need to configure the following distinct rules:
   • Audit Trail & IAM: Set the scope to your Organization and select the AuditTrailReadOnly and IAMReadOnly permission sets.
   • Instances: Set the scope to your specific Project (or Organization, if you want to monitor all projects) and select the InstancesReadOnly permission set.

Configure the add-on

Configuring the add-on involves three main steps:

1. Configure an account (a Scaleway Organization and corresponding API key).
2. Configure inputs (i.e., data ingestion sources).
3. Configure optional settings (add a proxy or change the log level).

Configure an account

Follow these steps to configure the Scaleway Add-on for Splunk:

1. On your Splunk platform instance, go to the Splunk Web homepage, then select Scaleway Add-on in the navigation. The Configuration tab of the add-on opens.
2. Configure an account. You must configure at least one account.
   1. On the Configuration tab, click the Accounts tab.
   2. Click the Add button. The Add Accounts window appears. Open Image over content
      Close current Lightbox
   3. Provide the required information in the fields marked with an asterisk:
      • Account name: Any descriptive name that helps you identify the account.
      • Organization ID: The identifier of the Scaleway Organization associated with the Scaleway API key. You can retrieve your Organization ID from the Scaleway console: select Organization Dashboard in the side menu, then click Copy ID.
      • SCW Secret Key: The API Secret Key that your Scaleway account will use to authenticate to Splunk. This is the Secret Key that was shown to you when you created your Scaleway API key in the Scaleway console.
   4. Repeat these steps for all the Organizations that you want Splunk to collect data from.

To complete the setup of the add-on, after configuring an account, you must specify one or more inputs (i.e., data ingestion sources).

Configure an input

A Splunk input is a data ingestion source that brings raw data into the Splunk platform.

To complete the setup of the add-on, you must configure data inputs on the specific Splunk node handling data collection for the add-on (usually a heavy forwarder). Scaleway recommends using Splunk Web for this configuration, but it is also possible to configure inputs manually via a configuration file.

Once the inputs are configured, the Scaleway Add-on continuously polls Scaleway Audit Trail APIs at the specified intervals and forwards events to Splunk for indexing and analysis.

To retrieve Audit Trail events/IAM logs/Instance server events for a Scaleway Organization and/or Project, complete the following steps.

1. On your Splunk platform instance, go to the Splunk Web homepage, then select Scaleway Add-on in the navigation.

2. Go to the Inputs tab and click the Create New Input button.

   Open Image over content
   Close current Lightbox

3. Select the relevant input type from the dropdown.

   Input type	Queried Scaleway endpoint
   Audit Trail events	/audit-trail/v1alpha1/regions/{region}/events
   Audit Trail authentication events	/audit-trail/v1alpha1/regions/{region}/authentication-events
   Audit Trail system events	/audit-trail/v1alpha1/regions/{region}/system-events
   IAM logs	/iam/v1alpha1/logs
   IAM users	/iam/v1alpha1/users
   IAM groups	/iam/v1alpha1/groups
   IAM applications	/iam/v1alpha1/applications
   Instance servers	/instance/v1/zones/{zone}/servers

   A window appears prompting you to enter details for your input.

4. Provide the required information (e.g., polling interval, Scaleway region). Obligatory fields are marked with an asterisk.

   Note that:

   • The minimum allowed polling Interval is 1 poll every 60 seconds.

   • The Index must correspond to the index in which the Audit Trail events data should be stored. The default is main.

   • The Project ID field is optional. If no Project ID is specified, the input will retrieve data from all the Scaleway Projects.

     To retrieve your Project ID, go to the Scaleway console, select Project Dashboard in the side menu, then click Copy ID.

   • The Product name field is optional. If no product name is specified, the input will retrieve data from all the Scaleway products.

     To retrieve a product name, go to the Scaleway console and select Monitoring > Audit Trail in the side menu. Use the product name as displayed in the Product dropdown on the Events tab. However, make sure that you use lowercase letters only (for example, instance) and omit the copyright sign from the name.

5. Verify that data is successfully arriving by running the following search on your search head.

   Input type	Search to run
   Audit Trail events	sourcetype=scaleway:audittrail_events*
   Audit Trail authentication events	sourcetype=scaleway:audittrail_authentication_events
   Audit Trail system events	sourcetype=scaleway:audittrail_system_events
   IAM logs	sourcetype=scaleway:iam:logs
   IAM users	sourcetype=scaleway:iam:users
   IAM groups	sourcetype=scaleway:iam:groups
   IAM applications	sourcetype=scaleway:iam:applications
   Instance servers	sourcetype=scaleway:instance

   If you do not see any events, check the Troubleshooting tab on your data collection node to verify that your accounts, forwarders, and inputs are all configured successfully.

Configure optional proxy and log level settings

You can configure optional proxy and log level settings on the Splunk platform instance that you have designated as your configuration server for the add-on.

The Scaleway Add-on supports HTTP/SOCKS proxies.

1. On your Splunk platform instance, go to the Splunk Web homepage, then select Scaleway Add-on in the navigation. The Configuration tab of the add-on opens.
2. If you need to use a proxy:
   1. Click the Proxy tab.
   2. Check the Enable box.
   3. Add your proxy details. If your proxy server does not require authentication, leave the Username and Password fields empty.
   4. Click Save.
3. If you want to change the logging level:
   1. Click the Logging tab.
   2. Select the Log Level.
   3. Click Save.

Upgrade the add-on

To upgrade the add-on, complete the following steps.

1. Disable all inputs.
2. Download the latest version of the Scaleway Add-on from Splunkbase.
3. Install the add-on across your deployment.
4. Enable all the configured inputs to resume the data collection.

Troubleshoot the add-on

For details, see I have issues with my Splunk integration.

Scaleway App for Splunk

The Scaleway App for Splunk is a visualization layer built for Scaleway Audit Trail data. While the add-on handles raw data collection, the application provides pre-built dashboards for security monitoring, with the option to create custom dashboards. It also records user access patterns and maintains chronological logs of resource changes to assist with event correlation. Built-in alerting logic notifies administrators about dropped events or security anomalies.

Before you start

To complete the actions presented below, you must have:

• Splunk Enterprise or Splunk Cloud Platform (supported versions: 9.4.x, 10.0.x, 10.2.x, 10.4.x)
• The Splunk admin role assigned to you for installing the app
• At least the Splunk power role assigned to you for configuring the app
• Installed and configured Scaleway Add-on for Splunk
• Audit Trail data flowing into Splunk

Install the app

You can install the Scaleway App via Splunk Web or the command line. Note that the app is supported only on search head instances.

1. Download the Scaleway App from Splunkbase.
2. Determine the best installation method for your deployment architecture.
3. Complete any required prerequisite steps.
4. Execute the installation.

For detailed instructions about how to install the app in a single-instance deployment, a distributed deployment, or Splunk Cloud, see the relevant sections in the Installing add-ons Splunk documentation:

• Single-instance Splunk Enterprise
• Distributed Splunk Enterprise
• Splunk Cloud

For distributed environments, the next section provides additional information.

Installation in distributed environments

The following table provides guidance on where and how to install the app within distributed Splunk Enterprise environments.

The following table provides a quick reference for the compatibility of the app with Splunk distributed deployment features.

Configure the app

Once the app has been installed, you can:

• Review pre-built dashboards
• Perform an initial data query
• Configure search macros
• Configure and enable alerts
• Configure automatic lookups, such as an identity lookup, a group lookup, an application lookup, or an asset lookup

Review pre-built dashboards

To access the pre-built dashboards, access Splunk and go to Apps > Scaleway App. The Scaleway - Data pipeline health status dashboard opens.

To switch between dashboards, use the side menu.

The following pre-built dashboards are available:

• Scaleway - Data pipeline health status: Displays data ingestion and event count metrics, as well as errors for the Scaleway audit data feed
• Scaleway - Authentication monitoring: Tracks login events, session details, credential usage, with options to filter by user
• Scaleway - Activity monitoring: Focuses on dividing views between account management actions (such as account creation, update, and deletion) and asset management events (such as methods used, successful and failed operations)

Perform an initial data query

To perform an initial query on the data ingested from your Scaleway infrastructure, follow these steps:

1. Access the Scaleway App in Splunk, and click Search in the side menu.
2. Enter a search query in the Search field. To formulate your queries, use the Splunk Search Processing Language (SPL).
   Tip

   Enter scaleway to display all the data obtained from your Scaleway infrastructure.

The source types are automatically assigned, but when running a search query, the following sourcetype information can be useful. The Scaleway Add-on provides the index-time and search-time knowledge for audit events in the following formats.

Configure search macros

The app relies on search macros to simplify the setup of dashboards, alerts, and reports. To learn more about search macros, see Use search macros in searches in the Splunk documentation.

The scaleway_index macro is used by the Scaleway App to reference the Splunk index where Scaleway events are stored. By default, the scaleway_index macro points to the main index.

Configure and enable alerts

The Scaleway App allows you to configure alerts to monitor:

• Spikes in error rates compared to the previous day by enabling the "Scaleway - Increased number of errors from yesterday" alert.
• Increases in failed login attempts by enabling the "Scaleway - Increased number of failed logins" alert.
• Interruptions in data ingestion by enabling the "Scaleway - No data ingesting in the last hour" alert.

Prerequisites:

• Since the "Scaleway - Increased number of failed logins" alert relies on logs with sourcetype=scaleway:audittrail_events:auths, ensure that the corresponding data input is enabled in the Scaleway Add-on.
• Configure search macros.

Steps:

1. Configure alerts:
   1. Go to Splunk Web > Splunk Search Head, and click Settings > Searches, reports, and alerts.
   2. Set a filter for the Scaleway App (DA-scaleway_app).
   3. Click the alert that you want to configure.
   4. In the Send email section, customize the settings according to your preferences.
   5. Click Save.
2. Enable alerts:
   1. Go to Splunk Web > Splunk Search Head, and click Settings > Searches, reports, and alerts.
   2. Set a filter for the Scaleway App (DA-scaleway_app).
   3. Click Edit next to the alert you want to enable.
   4. Click Enable.

Configure automatic identity lookup

The Scaleway App allows users to automate the population of the scaleway_identities lookup by enabling the "Scaleway - Populate identity lookup" report. This lookup automatically enriches events ingested via the Scaleway Add-on with user data context.

Prerequisites:

• Since the report relies on logs with sourcetype=scaleway:iam:users, ensure that the corresponding data input is enabled in the Scaleway Add-on.
• Configure search macros.
• The configuration of this mechanism requires Splunk Enterprise Security.

Enable the report:

Use Splunk Web to enable the "Scaleway - Populate identity lookup" report.

1. In the Splunk Search Head, click Settings > Searches, reports, and alerts.
2. Set a filter for the Scaleway App (DA-scaleway_app).
3. Click the Scaleway - Populate identity lookup report.
4. Set Earliest time and Latest time according to your needs:
   • If you are receiving the scaleway:iam:users events once per day, set Earliest time to -24h@h and Latest time to now.
   • If you are receiving the scaleway:iam:users events once per week, set Earliest time to -7d@d and Latest time to now.
5. Click Save.

Schedule the report:

Use Splunk Web to schedule the "Scaleway - Populate identity lookup" report.

1. In the Splunk Search Head, click Settings > Searches, reports, and alerts.
2. Set a filter for the Scaleway App (DA-scaleway_app).
3. Click Edit > Edit Schedule > Enable and Schedule Report to edit the Scaleway - Populate identity lookup report.
4. Set the scheduling according to your needs.
5. Click Save.

Configure Splunk Enteprise Security:

To allow Splunk Enterprise Security to enrich logs using the scaleway_identities lookup, you must configure the following settings:

1. Open the Splunk Enterprise Security application.
2. Click Configure > All configurations > Assets and identities > Identity lookups.
3. Click New > New configuration.
4. As Source, select the scaleway_identities lookup.
5. Add a name.
6. Add a category (a short descriptive category for this identity list, for example: 'scaleway_identities').
7. Add a description.
8. Click Save.

Configure automatic group lookup

The Scaleway App allows users to automate the population of the scaleway_groups lookup by enabling the "Scaleway - Populate group lookup" report. This lookup automatically enriches events ingested via the Scaleway Add-on with group data context.

Prerequisites:

• Since the report relies on logs with sourcetype=scaleway:iam:groups, ensure that the corresponding data input is enabled in the Scaleway Add-on.
• Configure search macros.

Enable the report:

Use Splunk Web to enable the "Scaleway - Populate group lookup" report.

1. In the Splunk Search Head, click Settings > Searches, reports, and alerts.
2. Set a filter for the Scaleway App (DA-scaleway_app).
3. Click the Scaleway - Populate group lookup report.
4. Set Earliest time and Latest time according to your needs:
   • If you are receiving the scaleway:iam:groups events once per day, set Earliest time to -24h@h and Latest time to now.
   • If you are receiving the scaleway:iam:groups events once per week, set Earliest time to -7d@d and Latest time to now.
5. Click Save.

Schedule the report:

Use Splunk Web to schedule the "Scaleway - Populate group lookup" report.

1. In the Splunk Search Head, click Settings > Searches, reports, and alerts.
2. Set a filter for the Scaleway App (DA-scaleway_app).
3. Click Edit > Edit Schedule > Enable and Schedule Report to edit the Scaleway - Populate group lookup report.
4. Set the scheduling according to your needs.
5. Click Save.

Configure automatic application lookup

The Scaleway App allows you to automate the population of the scaleway_applications lookup by enabling the "Scaleway - Populate application lookup" report. This lookup automatically enriches events ingested via the Scaleway Add-on with application data context.

Prerequisites:

• Since the report relies on logs with sourcetype=scaleway:iam:applications, ensure that the corresponding data input is enabled in the Scaleway Add-on.
• Configure search macros.

Enable the report:

Use Splunk Web to enable the "Scaleway - Populate application lookup" report.

1. In the Splunk Search Head, click Settings > Searches, reports, and alerts.
2. Set a filter for the Scaleway App (DA-scaleway_app).
3. Click the Scaleway - Populate application lookup report.
4. Set Earliest time and Latest time according to your needs:
   • If you are receiving the scaleway:iam:applications events once per day, set Earliest time to -24h@h and Latest time to now.
   • If you are receiving the scaleway:iam:applications events once per week, set Earliest time to -7d@d and Latest time to now.
5. Click Save.

Schedule the report:

Use Splunk Web to schedule the "Scaleway - Populate application lookup" report.

1. In the Splunk Search Head, click Settings > Searches, reports, and alerts.
2. Set a filter for the Scaleway App (DA-scaleway_app).
3. Click Edit > Edit Schedule > Enable and Schedule Report to edit the Scaleway - Populate application lookup report.
4. Set the scheduling according to your needs.
5. Click Save.

Configure automatic asset lookup

The Scaleway App allows you to automate the population of the scaleway_assets lookup by enabling the "Scaleway - Populate asset lookup" report. This lookup automatically enriches events ingested via the Scaleway Add-on with asset data context.

Prerequisites:

• Since the report relies on logs with sourcetype=scaleway:instance, ensure that the corresponding data input is enabled in the Scaleway Add-on.
• Configure search macros.
• The configuration of this mechanism requires Splunk Enterprise Security.

Enable the report:

Use Splunk Web to enable the "Scaleway - Populate asset lookup" report.

1. In the Splunk Search Head, click Settings > Searches, reports, and alerts.
2. Set a filter for the Scaleway App (DA-scaleway_app).
3. Click the Scaleway - Populate asset lookup report.
4. Set Earliest time and Latest time according to your needs:
   • If you are receiving the scaleway:instance events once per day, set Earliest time to -24h@h and Latest time to now.
   • If you are receiving the scaleway:instance events once per week, set Earliest time to -7d@d and Latest time to now.
5. Click Save.

Schedule the report:

Use Splunk Web to schedule the "Scaleway - Populate asset lookup" report.

1. In the Splunk Search Head, click Settings > Searches, reports, and alerts.
2. Set a filter for the Scaleway App (DA-scaleway_app).
3. Click Edit > Edit Schedule > Enable and Schedule Report to edit the Scaleway - Populate asset lookup report.
4. Set the scheduling according to your needs.
5. Click Save.

Configure Splunk Enteprise Security:

To allow Splunk Enterprise Security to enrich logs using the scaleway_assets lookup, you must configure the following settings:

1. Open the Splunk Enterprise Security application.
2. Click Configure > All configurations > Assets and identities > Asset lookups.
3. Click New > New configuration.
4. As Source, select the scaleway_assets lookup.
5. Add a name.
6. Add a category (a short descriptive category for this identity list, for example: 'scaleway_assets').
7. Add a description.
8. Click Save.

Upgrade the app

To upgrade the app, complete the following steps.

1. Download the latest version of the Scaleway App from Splunkbase.
2. Install the app across your deployment.

Troubleshoot the app

For details, see I have issues with my Splunk integration.

Appendix: Manual input configuration

While Scaleway recommends using Splunk Web for configuring inputs (i.e., data ingestion sources) for the add-on, it is also possible to configure inputs manually via a configuration file.

Manually configure Audit Trail inputs

To manually configure Audit Trail inputs using a configuration file, complete the following steps.

1. Create a $SPLUNK_HOME/etc/apps/TA-scaleway_addon/local/inputs.conf configuration file (if it is not already present).

2. Add the following stanza.

3. (Optional) Configure a custom index.

4. Restart your Splunk platform instance.

5. Verify that data is successfully arriving by running a search on your search head. For the search relevant to your input, see section Configure an input and the table that lists input types and corresponding searches.

   If you do not see any events, check the Troubleshooting tab on your data collection node to verify that your accounts, forwarders, and inputs are all configured successfully.

Manually configure IAM inputs

To manually configure IAM inputs using a configuration file, complete the following steps.

1. Create a $SPLUNK_HOME/etc/apps/TA-scaleway_addon/local/inputs.conf configuration file (if it is not already present).

2. Add the following stanza.

3. (Optional) Configure a custom index.

4. Restart your Splunk platform instance.

5. Verify that data is successfully arriving by running a search on your search head. For the search relevant to your input, see section Configure an input and the table that lists input types and corresponding searches.

   If you do not see any events, check the Troubleshooting tab on your data collection node to verify that your accounts, forwarders, and inputs are all configured successfully.

Manually configure Instance server inputs

To manually configure Instance server using a configuration file, complete the following steps.

1. Create a $SPLUNK_HOME/etc/apps/TA-scaleway_addon/local/inputs.conf configuration file (if it is not already present).

2. Add the following stanza.

   [instance_servers://<instance_servers_input_name>]
   interval = <value>
   index = <value>
   account = <value>
   zone = <value>

3. (Optional) Configure a custom index.

4. Restart your Splunk platform instance.

5. Verify that data is successfully arriving by running a search on your search head. For the search relevant to your input, see section Configure an input and the table that lists input types and corresponding searches.

   If you do not see any events, check the Troubleshooting tab on your data collection node to verify that your accounts, forwarders, and inputs are all configured successfully.