What does this guide cover?

Forward Mailgun email events to Splunk for real-time monitoring, alerting, and analytics. Get centralized visibility into deliverability, engagement, bounces, and other email metrics.

What is Mailgun?

Mailgun is a developer-centric email API focused on high deliverability, robust analytics, and flexible integration for both transactional and marketing emails. Mailgun provides domain verification, webhook tracking, and detailed delivery reports—making it ideal for applications that need reliable email delivery.

What is Splunk?

Splunk is a powerful platform for searching, monitoring, and analyzing machine-generated data from applications, websites, and infrastructure. Splunk collects and indexes data from virtually any source, then provides real-time dashboards, advanced search, and automated alerts. Widely used for security, compliance, and operational intelligence, Splunk helps teams gain deep visibility into system health, troubleshoot faster, and make data-driven decisions.

Prerequisites

Mailgun Account:

• Active verified domain (SPF/DKIM configured)
• Access to Mailgun Control Panel
• Webhooks enabled for your domain

Splunk System:

• Splunk Enterprise or Splunk Cloud account
• Administrative access
• HTTP Event Collector (HEC) enabled

Steps to Configure Mailgun and Splunk Integration

Step 1: Set Up HTTP Event Collector in Splunk

1. Enable HEC globally
   Follow Splunk's official guide: Set up and use HTTP Event Collector in Splunk Web
2. Create an HEC Token
   Follow Splunk's guide: Create an Event Collector token
   1. Recommended token name: "Mailgun Events"
   2. Recommended sourcetype: mailgun:events
   3. Choose your target index (or create a dedicated index for email events)
3. Copy your HEC credentials:
   1. HEC URL (format: https://<your-splunk-host>:8088/services/collector/event)
   2. HEC Token value

Step 2: Configure Mailgun Webhooks

1. Log in to Mailgun Control Panel
   Go to app.mailgun.com
2. Add a Webhook
   Navigate to Sending > Webhooks > Add Webhook
3. Configure webhook settings:
   1. URL: Paste your HEC endpoint URL from Step 1
   2. Event Types: Select all events you want to track (Delivered, Opened, Clicked, Failure, Complaint, etc.)
   3. Custom Header (Required for authentication):
      • Header Name: Authorization
      • Header Value: Splunk <your-HEC-token>
4. Save and test
   Click Create Webhook and optionally send a test event to verify connectivity.

Step 3: Verify Events in Splunk

1. Search your Splunk index for incoming Mailgun events:
   index=<your-index> sourcetype=mailgun:events
2. If successful, you'll see Mailgun events with fields like event, message_id, recipient, domain, etc.
3. Troubleshooting:
   For help, see Troubleshooting HTTP Event Collector in Splunk Docs.

Step 4: Build Dashboards and Alerts

Follow Splunk's guide: Creating Dashboards in Splunk Enterprise

Example searches for email metrics:

• Delivery rate: index=<index> event=delivered | stats count
• Bounce rate: index=<index> event=bounced | stats count
• Open rate: index=<index> event=opened | stats count
• Click-through rate: index=<index> event=clicked | stats count

For more advanced dashboard examples, see the community tutorial: Let's Build A Splunk Dashboard.

FAQ / Troubleshooting

Q: Events not appearing in Splunk.
A: Verify HEC is enabled, the token is correct, and your Mailgun webhook URL matches your HEC endpoint. See Splunk's troubleshooting guide: Troubleshooting HTTP Event Collector

Q: Authentication errors when sending events.
A: Double-check your HEC token in the Authorization: Splunk <token> header. Ensure there are no extra spaces or special characters.

Q: How do I create alerts on bounce spikes?
A: Create a saved search in Splunk and convert it to an alert. Example search: index=<index> event=bounced | timechart count. For help, see Splunk's alerting guide.

Q: Can I send to a specific Splunk index?
A: Yes. Set the target index when creating your HEC token, or override it in the webhook payload.

Q: How do I get support for Mailgun?
A: Contact Mailgun support: https://app.mailgun.com/support

References & Resources

Mailgun Resources:

• Mailgun Webhooks Documentation
• Mailgun Events Reference
• Mailgun Control Panel

Splunk Resources:

• Set up HTTP Event Collector
• Create Event Collector Token
• Creating Dashboards
• HTTP Event Collector Troubleshooting

Need Support?

Our Support Team here at Sinch Mailgun is happy to help! Reach out to us in the Support page of your Mailgun Control Panel, and we'll be with you shortly!