---
title: Set up a profile for manual event forwarding
description: Depending on the profile defined, Splunk ES notable events are forwarded manually as discrete notable events into the Security Operations environment of your ServiceNow AI Platform instance.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/splunk-event-manual-security.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: concept
last_updated: "2026-03-12"
reading_time_minutes: 1
breadcrumb: [Create an event profile, Splunk Enterprise Security event ingestion integration, Security Incident Response integrations, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Set up a profile for manual event forwarding

Depending on the profile defined, Splunk ES notable events are forwarded manually as discrete notable events into the Security Operations environment of your ServiceNow AI Platform instance.

To set up a profile for manual forwarding of notable events:

<table id="table_zs4_1xf_4jb"><thead><tr><th>

Task

</th><th>

Section

</th></tr></thead><tbody><tr><td>

Create an event profile

</td><td>

See [Create a profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/splunk-event-create-profile-manual-security.md)

</td></tr><tr><td>

Map notable event fields

</td><td>

See [Explore Mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/splunk-event-ingest_mapping-security.md)

</td></tr><tr><td>

Create custom mappings

</td><td>

See [Create mappings for Splunk ES notable event incident review and contributing event details \(manual forwarding\)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/splunk-event-ingest-map-manual-security.md)

</td></tr><tr><td>

Preview the security incident

</td><td>

See [Preview security incident](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/splunk-event-ingest-preview-security.md)

</td></tr><tr><td>

Set up your Splunk environment for manual ingestion

</td><td>

[Create a profile](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/splunk-event-create-profile-manual-security.md)

</td></tr><tr><td>

Automate notable event updates and closure based on SIR incident status

</td><td>

See [Automate notable event updates and closures](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/splunk-additional-security.md)

</td></tr></tbody>
</table>