Skip to content
Proxus 2.0.0 Proxus 2.0: the largest release in Proxus history Release notes
Try free Book a demo

Integrations · Splunk

Industrial events alongside the rest of your telemetry.

Where Splunk is already the place operational events are investigated, Proxus can send plant readings, and the events your pipelines and rules raise, to its HTTP Event Collector, so an OT incident and an IT incident are examined in the same tool.

Book a demo All integrations Setup guide
Equipment to Splunk Splunk
Model once, deliver to your systems Equipment sends data through an edge gateway to Unified Namespace, then to Splunk. Controllers S7 / CIP / MELSEC Machines & robots FOCAS / MTConnect Meters & SCADA Modbus / OPC UA Modelled signals 02 / EDGE Proxus Edge Collect / evaluate / buffer 03 / PLATFORM Unified Namespace Modelled industrial signals Splunk Destination 01 / PLANT FLOOR04 / CONSUMERS Model once, deliver to your systems Read from bottom to top. Field equipment is at the bottom and data travels upward. Equipment sends data through an edge gateway to Unified Namespace, then to Splunk. 01 Plant floor PLCs / CNCs / robots 02 Proxus Edge Collect / evaluate /buffer 03 Unified Namespace Modelled industrialsignals 04 Splunk Destination
Sends
Readings, plus the alarms and values your pipelines and rules send
Context
Each event carries device name and ID, tag, value and timestamp, with sourcetype device_metrics
Reliability
Edge buffering when the endpoint is unreachable
Scope
You choose which devices send; Pipelines Only sends just what a pipeline selects

Data path

What actually moves, and where it stops.

Edge rules decide what counts as an event before it is sent

Model once, deliver to your systems Equipment sends data through an edge gateway to Unified Namespace, then to Splunk. Controllers S7 / CIP / MELSEC Machines & robots FOCAS / MTConnect Meters & SCADA Modbus / OPC UA Modelled signals 02 / EDGE Proxus Edge Collect / evaluate / buffer 03 / PLATFORM Unified Namespace Modelled industrial signals Splunk Destination 01 / PLANT FLOOR04 / CONSUMERS Model once, deliver to your systems Read from bottom to top. Field equipment is at the bottom and data travels upward. Equipment sends data through an edge gateway to Unified Namespace, then to Splunk. 01 Plant floor PLCs / CNCs / robots 02 Proxus Edge Collect / evaluate /buffer 03 Unified Namespace Modelled industrialsignals 04 Splunk Destination

Field

  • PLCs, CNCs, robots
  • OPC UA servers
  • Meters and SCADA

Proxus

  • Collect at the line
  • Model into the namespace
  • Buffer and forward

Splunk

Splunk
  • events
  • index
  • search and alerting

How it works

From the machine to Splunk, in four steps.

  1. 01

    Decide what matters

    Rules and anomaly detection at the edge turn raw changes into events worth recording, and a pipeline sends them to Splunk.

  2. 02

    Name the source

    Each event names the device and tag it came from, with the value and timestamp.

  3. 03

    Deliver to Splunk

    An outbound target posts events to the HTTP Event Collector you configure.

  4. 04

    Correlate

    Plant events sit next to infrastructure events for joint investigation.

What you get

Why teams route Splunk through Proxus.

  • Events, not noise

    With Pipelines Only, what arrives is what your edge rules decided was worth sending.

  • Indexed at read time

    Each event carries the time its value was read, so values sent after an outage are indexed where they belong.

  • Controlled outflow

    Only the devices and events you select leave the plant network.

  • One investigation surface

    OT and IT signals examined together instead of in separate tools.

Where it is used

Typical deployments.

  • OT security monitoring

    Bring plant-side events into the same view as network and system telemetry.

  • Incident investigation

    Look at what the line was doing next to what happened in infrastructure.

  • Compliance evidence

    Retain operational events in the system your auditors already accept.

Targets
Splunk HTTP Event Collector over HTTPS, with token and optional indexer acknowledgment; REST endpoints and message brokers are also supported
Payload
One event per value: deviceName, deviceId, key (tag name), value and timestamp; sourcetype device_metrics
Strategies
Pipelines Only for events from rules and pipelines; On Change for continuous signals
Security
HTTPS when the Url starts with https://, with the collector’s certificate verified; optional client and trusted server certificates from the Certificate Store; the token is masked in the hub
You configure
Url (HTTP Event Collector), Token, UseAcknowledgment. Test Connection checks the address and credentials from the hub or from a gateway you choose, without writing data.
Setup guide All target parameters

Proven in production

Running in production at these plants.

All deployments

Questions

Before you wire it up.

Are you sending raw plant telemetry to Splunk?
Usually not, and we would not recommend it. Rules and anomaly detection at the edge decide what counts as an event; with the target set to Pipelines Only, only what your pipelines send reaches Splunk.
What context comes with an event?
The device name and ID, the tag name, the value and a timestamp, with sourcetype device_metrics.
Can this support OT security monitoring?
It contributes to it: plant-side operational events become correlatable with infrastructure telemetry. It is a data source for your security programme, not a security product on its own.
Do we control what leaves the plant network?
Yes. You choose which devices send to the target, Pipelines Only narrows it to what a pipeline sends, and delivery is outbound from inside the network.

Other integrations

Next step

See it delivering into your own Splunk.

Bring one machine and a Splunk HTTP Event Collector token. We connect the machine, send its readings and rule events to Splunk in front of you, and search them next to your other data.

Book a demo Talk to an engineer
  1. 01

    Scoping call

    Equipment, protocols, sites and the systems the data has to reach.

  2. 02

    Technical walkthrough

    A working demo against a scenario that resembles your plant, not a generic tour.

  3. 03

    Pilot plan

    A defined first line or site, with the deployment and security questions answered up front.

  4. 04

    Roll-out

    The same templates bring the next lines and sites online.