# Streaming logs

You can stream [logs](https://help.camio.com/hc/en-us/articles/360060918592-Exporting-logs-to-Splunk#h_01F7N457J9TJSCPW6CKRC5F0F2) to Splunk via the [Splunk Add-on for Google Cloud Platform](https://docs.splunk.com/Documentation/AddOns/released/GoogleCloud/About).

This feature must first be enabled for your domain by contacting [support@camio.com.](mailto:support@camio.com)

Camio creates a custom [Log Router](https://cloud.google.com/logging/docs/routing/overview?hl=it#log-router) for your domain that writes [events](https://help.camio.com/hc/en-us/articles/360060918592-Exporting-logs-to-Splunk#h_01F7N457J9TJSCPW6CKRC5F0F2) to the Cloud Pub/Sub topic, from which [your Splunk Add-on pulls logs](https://cloud.google.com/architecture/exporting-stackdriver-logging-for-splunk#configure_splunk_add-on_for_gcp) with the JSON [payload](https://help.camio.com/hc/en-us/articles/360060918592-Exporting-logs-to-Splunk#h_01FGMV69461MRW7XHTEZ2JDYZT).

# Events logged to Splunk

|     |     |
| --- | --- |
| **Key** | **Definition** |
| Box State Sampled | Camio servers contacted the Box to get all of the settings and status |
| Box Config Changed | A user made a change to a Box setting |
| App Open | A user has opened [https://camio.com/app](/content/app/index.html) (or refreshed) |
| Account Created | A new user was created at [https://camio.com/app](/content/app/index.html) |
| Box Claimed | An attempt to register a Box was made |
| Box Deleted | A Box was deleted from an Account |
| Box Registered | A Box was registered to an Account |
| Camio Created | An event was shared via a link or Saved |
| Guest Added | A new Guest Account was created under the Account |
| Searched | A user searched for events or refreshed the real time feed |
| Sign in | A user has presented credentials to sign in |
| Sign out | A user signed out at [https://camio.com/app](/content/app/index.html) |
| Zone Created | A new zone was created at [https://camio.com/app/editor/?camera=](/content/app/editor/?camera=/index.html) |
| Label Updated | A label was added, updated, or deleted |
| Domain Changed | A setting at [https://camio.com/domains](/content/domains/index.html) was changed |
| Cameras Exported | Cameras were exported from a Box at [https://camio.com/boxes](/content/boxes/index.html) |
| Download | A user downloaded event(s) as a Zip or CSV file |
| Removed | A user has Removed an event from the feed |
| Live Stream Interaction | A user started or stopped a live stream via [https://camio.com/app/#live](/content/app/#live/index.html) |
| Policy Acknowledged | A user acknowledged a domain's usage policy |

# Payload

The payload of each event above is a JSON object that includes one or more lines in the **protoPayload**.

For example, **protoPayload.line[1].logMessage** looks like this for the "Box State Sampled" event: