---
title: "Meshlet Configurations for Splunk"
canonical: "https://docs.perspectium.com/space/Iodine/1705081/Meshlet%20Configurations%20for%20Splunk"
format: markdown
---
To enhance your DataSync integration for **Splunk Enterprise**, you can optionally configure the Splunk meshlet to the directives listed below. To check out the general meshlet configurations, see [General Meshlet Configurations for DataSync](https://docs-perspectium.atlassian.net/wiki/spaces/helium/pages/2142212).
| **Directive** | **Description** |
| --- | --- |
| [**ackUrl**](https://docs-perspectium.atlassian.net/wiki/spaces/Iodine/pages/1705085) | Represents the Splunk URL for enabling [indexer acknowledgement](https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/AboutHECIDXAck)
```yml
splunk:
ackUrl: http://splunk-url/services/collector/ack
requestChannel: a7175f62-d67b-4793-a172-c1b946c0e444
``` |
| [**requestChannel**](https://docs-perspectium.atlassian.net/wiki/spaces/Iodine/pages/1705085) | Represents a [channel](https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/AboutHECIDXAck#About_channels_and_sending_data) to be used with indexer acknowledgement.
:info: **NOTE****: **This configuration is to be used with the **ackUrl **configuration.
```yml
splunk:
ackUrl: http://splunk-url/services/collector/ack
requestChannel: a7175f62-d67b-4793-a172-c1b946c0e444
``` |
| [**saveInEvent**](https://docs-perspectium.atlassian.net/wiki/spaces/Iodine/pages/1705083) | By default, data is saved into Splunk where the event name is the **name** field of the outbound message such as **incident.bulk** and the fields of the shared record are saved as fields in the Splunk event. However, when **saveInEvent** is enabled, all the data for the record's fields will be saved in the **Event** name instead. See [View your event collections in Splunk](https://docs-perspectium.atlassian.net/wiki/spaces/Iodine/pages/1705083) for more details.
```yml
perspectium:
message:
inboundQueue: psp.in.meshlet.splunk.yourinstance
outboundQueue: psp.out.meshlet.splunk.%s
errorQueuePattern: psp.out.meshlet.splunk.error.%s
saveInEvent: true
``` |
| **sourceType** | A value for the [source type](https://docs.splunk.com/Splexicon:Sourcetype) of each record saved into Splunk. You can specify to use the table name of an incoming record by adding the **$table** value in **sourceType**. For example, if you send incident records and specify the **sourceType **configuration as **snow $table**, each incident record will be saved with a source type value of **snow** **incident**.
```yml
perspectium:
splunk:
url: http://3.46.13.38:8088/services/collector/event
authorizationHeader: " Splunk 0bfb9d66-8d5f-4fef-bae9-afa5a0642f21"
sourceType: snow:$table
``` |
| **hideEmptyFields** | Enable skipping empty field values of each record saved into Splunk. For example, with this configuration set as **true **and the meshlet receives an incident record with the field **assigned_to **empty, the **assigned_to **field will not be created when the record is saved into Splunk. If this configuration is not specified, the defaults value is **false** where empty fields are saved.
```yml
perspectium:
message:
hideEmptyFields: true
``` |