---
title: "Configure Splunk"
slug: "configure-splunk"
updated: 2026-09-09T16:09:29Z
published: 2026-09-09T16:09:29Z
canonical: "docs.redcanary.com/configure-splunk"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Splunk

With Splunk, you can search and explore the telemetry that Zscaler MDR’s Linux EDR has gathered. There are a couple of ways to enable this feature.

## Option 1: Zscaler MDR > AWS S3 > Splunk

Canary Exporter sends standardized telemetry to your AWS S3 bucket. This provides support for Splunk Cloud and Splunk On-prem.

### Install Splunk Cloud/On-prem instance

Configure a Generic S3 input to collect the data into Splunk.

### IAM policy for the bucket

```plaintext
{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "VisualEditor0",
 "Effect": "Allow",
 "Action": [
   "s3:PutObject",
   "s3:AbortMultipartUpload",
   "s3:ListMultipartUploadParts"
 ],
 "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/DESIRED_PREFIX/*"
 }
 ]
}
```

Learn more about [configuring Generic S3 inputs for the Splunk Add-on for AWS](https://docs.splunk.com/Documentation/AddOns/released/AWS/S3).

If you would like to use this option, please contact Zscaler MDR.

## Option 2: Local Collection > Splunk

Run Canary Exporter on your endpoint to collect and spool the telemetry locally. Configure your Splunk Universal Forwarder to send the locally spooled data to your Splunk Cloud or On-prem instance.