---
title: Installing and configuring Splunk for PingIntelligence
description: To complete the configuration of Splunk for PingIntelligence, you need to create a source type. Creating a source type helps Splunk to understand the event format.
component: pingintelligence
version: 5.1
page_id: pingintelligence:pingintelligence_dashboard:pingintelligence_configure_splunk
canonical_url: https://docs.pingidentity.com/pingintelligence/5.1/pingintelligence_dashboard/pingintelligence_configure_splunk.html
revdate: April 3, 2024
section_ids:
  before-you-begin: Before you begin
  about-this-task: About this task
  steps: Steps
---

# Installing and configuring Splunk for PingIntelligence

## Before you begin

To complete the configuration of Splunk for PingIntelligence, you need to create a source type. Creating a source type helps Splunk to understand the event format.

## About this task

The source type is one of the default fields that Splunk assigns to all the incoming data. Configuring the source type informs Splunk about the type of data ABS provides. This helps Splunk in formatting data intelligently during indexing.

To create a source type:

## Steps

1. Configure a new source type by navigating to **Splunk Enterprise → Settings → Source Types → New Source type**. The source type events page is displayed.

2. Configure the **New Source type**.

   The fields are defined in the following table.

   | Name                | Value                                           |
   | ------------------- | ----------------------------------------------- |
   | Source type name    | `pi_events_source_type`                         |
   | Destination app     | Search and reporting (Can change for your apps) |
   | Category            | Structures                                      |
   | Indexed extractions | `json`                                          |
   | SEDCMD-alter        | `s/pi-attack-info-//`                           |

   ![A screen capture of the Edit Source Type window.](../_images/aoc1576566153846.png)

3. Create a new index `pi_events` by navigating to **Enterprise → Settings → Indexes → New Index**.

![A screen capture of the New Index window.](../../5.2/_images/fzk1576572831979.png)