@ChandanH17473188

A simple way to onboard Pega SaaS logs to Splunk Cloud. First decide the route: Splunk HTTP Event Collector over TLS is simplest; object storage ingestion from S3 or Azure Blob also works. Ask Pega Cloud Ops to enable log streaming for your tenant and share the HEC URL, port 443, the HEC token, and your TLS requirements, or give them the bucket details if you choose storage. Specify which logs you want sent such as PegaRULES, ALERT, PEGA, access, GC, and the environments. In Splunk Cloud, create the target index and HEC token, set sourcetype to pega:rules or your own, and turn on time extraction for multiline events. If using storage, install the Splunk add-on to pull from that bucket and map to the right index and sourcetype. Ask Pega to set the batch size and flush interval to avoid latency spikes, and confirm retries and dead letter handling. Validate in lower env by triggering a test exception and checking fields like requestor, node, thread, and pxObjClass. Lock it down with IP allowlisting, TLS 1.2, token rotation, and document retention and PII filtering before promoting to production.