[{"data":1,"prerenderedAt":854},["ShallowReactive",2],{"doc:\u002Fdocs\u002Fsiem-splunk":3,"docs-nav":631},{"id":4,"title":5,"body":6,"description":622,"extension":623,"meta":624,"navigation":626,"path":627,"seo":628,"stem":629,"__hash__":630},"docs\u002Fdocs\u002Fsiem-splunk.md","Audit log to Splunk",{"type":7,"value":8,"toc":613},"minimark",[9,13,32,37,80,87,91,96,171,184,187,194,207,211,218,419,422,469,474,477,485,489,538,542,549,560,564,598,602,609],[10,11,5],"h1",{"id":12},"audit-log-to-splunk",[14,15,16,20,21,26,27,31],"p",{},[17,18,19],"strong",{},"Administration → SIEM"," sends every entry of the audit log to Splunk through the\nHTTP Event Collector (HEC), within about fifteen seconds, for the security team and\nwhoever runs Tabularia. Application logs and metrics are not part of it: those are\ncollected at the infrastructure level (Universal Forwarder, the Docker logging\ndriver; see ",[22,23,25],"a",{"href":24},"\u002Fdocs\u002Fintegrations\u002Fmonitoring","Monitoring","). The other integrations are\nlisted in ",[22,28,30],{"href":29},"\u002Fdocs\u002Fintegrations","Integrations",".",[33,34,36],"h2",{"id":35},"in-splunk","In Splunk",[38,39,40,51,73],"ol",{},[41,42,43,46,47,31],"li",{},[17,44,45],{},"Settings → Indexes → New Index",": a dedicated index, for example ",[48,49,50],"code",{},"tabularia",[41,52,53,56,57],{},[17,54,55],{},"Settings → Data inputs → HTTP Event Collector → New Token",":\n",[58,59,60,67],"ul",{},[41,61,62,63,66],{},"source type ",[48,64,65],{},"tabularia:audit",", or leave it to Tabularia, which sets it on every\nevent;",[41,68,69,72],{},[17,70,71],{},"Allowed indexes",": only the index above. This matters. With a token that may\nwrite anywhere, an event sent to a misspelled index is accepted and then dropped\nby Splunk, so it is lost while Tabularia counts it as delivered. A token limited\nto its index refuses it instead, and the error shows in Tabularia.",[41,74,75,76,79],{},"Note the HEC address. It is usually ",[48,77,78],{},"https:\u002F\u002F\u003Csplunk>:8088",". The token is the\nvalue Splunk shows once.",[14,81,82,83,86],{},"Indexer acknowledgment (",[48,84,85],{},"useACK",") can be on or off: Tabularia sends a channel on\nevery request.",[33,88,90],{"id":89},"in-tabularia","In Tabularia",[14,92,93,95],{},[17,94,19],{},", as an administrator:",[97,98,99,111],"table",{},[100,101,102],"thead",{},[103,104,105,109],"tr",{},[106,107,108],"th",{},"Field",[106,110],{},[112,113,114,131,139,147,163],"tbody",{},[103,115,116,120],{},[117,118,119],"td",{},"HTTP Event Collector address",[117,121,122,123,126,127,130],{},"the base is enough (",[48,124,125],{},"https:\u002F\u002Fsplunk.example.com:8088","). The ",[48,128,129],{},"\u002Fservices\u002Fcollector\u002Fevent"," path is added; a full path, or a proxy's own path, is kept as is",[103,132,133,136],{},[117,134,135],{},"HEC token",[117,137,138],{},"stored encrypted (Fernet), never shown again",[103,140,141,144],{},[117,142,143],{},"Index",[117,145,146],{},"empty = the token's default index",[103,148,149,152],{},[117,150,151],{},"Sourcetype \u002F Source \u002F Host",[117,153,154,155,157,158,157,160,162],{},"default ",[48,156,65],{}," \u002F ",[48,159,50],{},[48,161,50],{},". Use Host to tell installations apart",[103,164,165,168],{},[117,166,167],{},"Verify Splunk's certificate",[117,169,170],{},"on by default (see below)",[14,172,173,176,177,180,181,31],{},[17,174,175],{},"Send a test event"," sends one event immediately and shows Splunk's answer: a wrong\ntoken, a refused index, a certificate problem or an unreachable address show up\nhere. Find the event in Splunk with ",[48,178,179],{},"sourcetype=\"tabularia:audit\" action=siem.test",".\nThen ",[17,182,183],{},"Turn forwarding on",[14,185,186],{},"The first time forwarding is turned on, it starts from that moment; the earlier\nhistory stays on the Audit page. Turning it off and on again resumes where it\nstopped, so the entries made in between are sent too.",[14,188,189],{},[190,191],"img",{"alt":192,"src":193},"Administration, SIEM: forwarding off, the counters, and the destination with the HEC address https:\u002F\u002Fsplunk.example.com:8088, the token stored, index tabularia, host tabularia-prod, Verify Splunk's certificate ticked, Save and Send a test event","\u002Fmedia\u002Fguide\u002Fadmin\u002Fsiem-splunk-form.png",[14,195,196],{},[197,198,199,201,202,204,205,31],"em",{},[17,200,19],{}," filled in as in the table above: the token is stored and never shown; ",[17,203,175],{}," before ",[17,206,183],{},[33,208,210],{"id":209},"the-events","The events",[14,212,213,214,217],{},"One HEC event per audit entry, with the entry's time as ",[48,215,216],{},"_time",":",[219,220,225],"pre",{"className":221,"code":222,"language":223,"meta":224,"style":224},"language-json shiki shiki-themes github-dark-dimmed github-light","{\n  \"id\": 2724,\n  \"time\": \"2026-10-12T15:46:46.707Z\",\n  \"action\": \"auth.login_failed\",\n  \"outcome\": \"failure\",\n  \"user\": \"anna@example.com\",\n  \"user_id\": 12,\n  \"src\": \"10.1.2.3\",\n  \"user_agent\": \"Mozilla\u002F5.0 …\",\n  \"target_type\": \"user\",\n  \"target_id\": 12,\n  \"target_label\": \"anna@example.com\",\n  \"detail\": {\"reason\": \"password\"},\n  \"app\": \"tabularia\"\n}\n","json","",[48,226,227,236,253,267,280,293,306,319,332,345,358,370,382,402,413],{"__ignoreMap":224},[228,229,232],"span",{"class":230,"line":231},"line",1,[228,233,235],{"class":234},"ssh_m","{\n",[228,237,239,243,246,250],{"class":230,"line":238},2,[228,240,242],{"class":241},"sJK54","  \"id\"",[228,244,245],{"class":234},": ",[228,247,249],{"class":248},"swcJU","2724",[228,251,252],{"class":234},",\n",[228,254,256,259,261,265],{"class":230,"line":255},3,[228,257,258],{"class":241},"  \"time\"",[228,260,245],{"class":234},[228,262,264],{"class":263},"sXfbr","\"2026-10-12T15:46:46.707Z\"",[228,266,252],{"class":234},[228,268,270,273,275,278],{"class":230,"line":269},4,[228,271,272],{"class":241},"  \"action\"",[228,274,245],{"class":234},[228,276,277],{"class":263},"\"auth.login_failed\"",[228,279,252],{"class":234},[228,281,283,286,288,291],{"class":230,"line":282},5,[228,284,285],{"class":241},"  \"outcome\"",[228,287,245],{"class":234},[228,289,290],{"class":263},"\"failure\"",[228,292,252],{"class":234},[228,294,296,299,301,304],{"class":230,"line":295},6,[228,297,298],{"class":241},"  \"user\"",[228,300,245],{"class":234},[228,302,303],{"class":263},"\"anna@example.com\"",[228,305,252],{"class":234},[228,307,309,312,314,317],{"class":230,"line":308},7,[228,310,311],{"class":241},"  \"user_id\"",[228,313,245],{"class":234},[228,315,316],{"class":248},"12",[228,318,252],{"class":234},[228,320,322,325,327,330],{"class":230,"line":321},8,[228,323,324],{"class":241},"  \"src\"",[228,326,245],{"class":234},[228,328,329],{"class":263},"\"10.1.2.3\"",[228,331,252],{"class":234},[228,333,335,338,340,343],{"class":230,"line":334},9,[228,336,337],{"class":241},"  \"user_agent\"",[228,339,245],{"class":234},[228,341,342],{"class":263},"\"Mozilla\u002F5.0 …\"",[228,344,252],{"class":234},[228,346,348,351,353,356],{"class":230,"line":347},10,[228,349,350],{"class":241},"  \"target_type\"",[228,352,245],{"class":234},[228,354,355],{"class":263},"\"user\"",[228,357,252],{"class":234},[228,359,361,364,366,368],{"class":230,"line":360},11,[228,362,363],{"class":241},"  \"target_id\"",[228,365,245],{"class":234},[228,367,316],{"class":248},[228,369,252],{"class":234},[228,371,373,376,378,380],{"class":230,"line":372},12,[228,374,375],{"class":241},"  \"target_label\"",[228,377,245],{"class":234},[228,379,303],{"class":263},[228,381,252],{"class":234},[228,383,385,388,391,394,396,399],{"class":230,"line":384},13,[228,386,387],{"class":241},"  \"detail\"",[228,389,390],{"class":234},": {",[228,392,393],{"class":241},"\"reason\"",[228,395,245],{"class":234},[228,397,398],{"class":263},"\"password\"",[228,400,401],{"class":234},"},\n",[228,403,405,408,410],{"class":230,"line":404},14,[228,406,407],{"class":241},"  \"app\"",[228,409,245],{"class":234},[228,411,412],{"class":263},"\"tabularia\"\n",[228,414,416],{"class":230,"line":415},15,[228,417,418],{"class":234},"}\n",[14,420,421],{},"Empty fields are left out.",[58,423,424,434,463],{},[41,425,426,429,430,433],{},[48,427,428],{},"user"," and ",[48,431,432],{},"src"," are the names Splunk's CIM expects for who and from where.",[41,435,436,439,440,443,444,443,447,252,450,443,453,443,456,443,459,462],{},[48,437,438],{},"action"," is the audit action: ",[48,441,442],{},"auth.login",", ",[48,445,446],{},"auth.login_failed",[48,448,449],{},"flow.create",[48,451,452],{},"export.download",[48,454,455],{},"permission.grant",[48,457,458],{},"token.create",[48,460,461],{},"engine_settings.update",", …\n(the Audit page lists them).",[41,464,465,468],{},[48,466,467],{},"detail"," carries the action's context: the export format and rows, the token name\nwhen an API token did it, the old and new values of a setting.",[14,470,471,472,31],{},"Observers' IP addresses are not recorded, so their events have no ",[48,473,432],{},[14,475,476],{},"Useful searches:",[219,478,483],{"className":479,"code":481,"language":482},[480],"language-text","sourcetype=\"tabularia:audit\" action=auth.login_failed | stats count by user, src\nsourcetype=\"tabularia:audit\" outcome=failure | timechart count by action\nsourcetype=\"tabularia:audit\" detail.token=* | stats count by detail.token, action\n","text",[48,484,481],{"__ignoreMap":224},[33,486,488],{"id":487},"delivery","Delivery",[58,490,491,497,510,516,522,528],{},[41,492,493,496],{},[17,494,495],{},"Nothing skipped."," The audit table is the queue. Tabularia remembers the last\nentry Splunk confirmed and moves on only after Splunk answers with success. If\nSplunk is down, or the token is wrong, entries wait. Retries come after 5, 10,\n20 s and so on, up to 5 minutes, and resume from the first unconfirmed entry. The\npanel shows the waiting entries, the last error and the next attempt.",[41,498,499,502,503,245,506,509],{},[17,500,501],{},"At least once."," A delivery interrupted between Splunk's answer and Tabularia\nrecording it is sent again. Every event carries the entry's ",[48,504,505],{},"id",[48,507,508],{},"| dedup id","\nremoves the rare duplicate.",[41,511,512,515],{},[17,513,514],{},"In order",", in batches of up to 500 events and under 1 MB.",[41,517,518,521],{},[17,519,520],{},"One sender."," With several gateway replicas and orchestrators, a lock in the\ndatabase lets one process send at a time.",[41,523,524,527],{},[17,525,526],{},"Entries are sent once they are at least 10 seconds old."," An entry's id is\nassigned before it is committed, so a newer entry may become visible before an\nolder one. The delay keeps the position from moving past an entry that is not\nwritten yet.",[41,529,530,533,534,537],{},[17,531,532],{},"Retention wins."," ",[48,535,536],{},"AUDIT__RETENTION_MINUTES"," is the promise made in the privacy\nnotice. If Splunk receives nothing for longer than that, the oldest entries are\ndeleted before they are sent. The panel shows how far behind forwarding is, so\nalerting on it is possible long before that.",[33,539,541],{"id":540},"tls","TLS",[14,543,544,545,548],{},"The connection goes to the address the name resolved to, as for webhooks, and the\ncertificate is checked against the name. Public certificate authorities are\ntrusted. For a company authority, give the gateway its bundle with ",[48,546,547],{},"SSL_CERT_FILE","\n(the bundle replaces the public ones, so include them if needed).",[14,550,551,552,555,556,559],{},"Splunk's factory certificate is self-signed and issued for another name, so it fails\nthe check. The panel says so (",[48,553,554],{},"CERTIFICATE_VERIFY_FAILED","). ",[17,557,558],{},"Verify Splunk's\ncertificate"," can be turned off for that case, on an internal network only: without\nthe check, anyone in the middle can read the log and the token. A proper certificate\non the HEC is the real fix.",[33,561,563],{"id":562},"who","Who",[58,565,566,572,578,584],{},[41,567,568,571],{},[17,569,570],{},"Administrators"," change the destination and send tests.",[41,573,574,577],{},[17,575,576],{},"Observers"," see the state, without the full address or Splunk's error text.",[41,579,580,583],{},[17,581,582],{},"API tokens"," cannot change the destination: a leaked token must not be able to\nredirect the audit log.",[41,585,586,589,590,593,594,597],{},[17,587,588],{},"Changes are audited:"," every change (",[48,591,592],{},"siem.update",", with what changed but never\nthe token) and every test (",[48,595,596],{},"siem.test",") is itself an audit entry, so it reaches\nSplunk as well.",[33,599,601],{"id":600},"upgrading","Upgrading",[14,603,604,605,608],{},"Schema revision 0005 adds an empty ",[48,606,607],{},"siem_destinations"," table: forwarding stays off\nuntil an administrator turns it on.",[610,611,612],"style",{},"html pre.shiki code .ssh_m, html code.shiki .ssh_m{--shiki-default:#ADBAC7;--shiki-light:#24292E}html pre.shiki code .sJK54, html code.shiki .sJK54{--shiki-default:#8DDB8C;--shiki-light:#005CC5}html pre.shiki code .swcJU, html code.shiki .swcJU{--shiki-default:#6CB6FF;--shiki-light:#005CC5}html pre.shiki code .sXfbr, html code.shiki .sXfbr{--shiki-default:#96D0FF;--shiki-light:#032F62}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}",{"title":224,"searchDepth":238,"depth":255,"links":614},[615,616,617,618,619,620,621],{"id":35,"depth":238,"text":36},{"id":89,"depth":238,"text":90},{"id":209,"depth":238,"text":210},{"id":487,"depth":238,"text":488},{"id":540,"depth":238,"text":541},{"id":562,"depth":238,"text":563},{"id":600,"depth":238,"text":601},"Administration → SIEM sends every entry of the audit log to Splunk through the\nHTTP Event Collector (HEC), within about fifteen seconds, for the security team and\nwhoever runs Tabularia. Application logs and metrics are not part of it: those are\ncollected at the infrastructure level (Universal Forwarder, the Docker logging\ndriver; see Monitoring). The other integrations are\nlisted in Integrations.","md",{"source":625},"docs\u002Fsiem-splunk.md",true,"\u002Fdocs\u002Fsiem-splunk",{"title":5,"description":622},"docs\u002Fsiem-splunk","mMjVomhQd_rQlLbcKcPQRnRzXuu0avfLpOh99El-lZk",[632,651,707,739,771,794,820,846],{"title":633,"icon":634,"intro":635,"items":636},"Getting started","start","Install it on one machine, learn the few ideas everything else is built on, and run a first flow.",[637,639,642,645,648],{"path":638,"title":633},"\u002Fdocs\u002Fgetting-started",{"path":640,"title":641},"\u002Fdocs\u002Fgetting-started-docker-compose","Walkthrough with Docker Compose",{"path":643,"title":644},"\u002Fdocs\u002Fdeploy\u002Fminikube","Try it on your computer (minikube)",{"path":646,"title":647},"\u002Fdocs\u002Fconcepts","Concepts",{"path":649,"title":650},"\u002Fdocs\u002Foverview","Overview (README)",{"title":652,"icon":653,"intro":654,"items":655},"Capabilities","capabilities","What you can build: visual flows, analysis on any step, AI questions, pixel-perfect reports, dashboards, Python, R and SQL scripts, containers and the orchestration that ties them together.",[656,659,662,665,668,671,674,677,680,683,686,689,692,695,698,701,704],{"path":657,"title":658},"\u002Fdocs\u002Fcapabilities","All capabilities",{"path":660,"title":661},"\u002Fdocs\u002Fcapabilities\u002Fflows","Low-code flows",{"path":663,"title":664},"\u002Fdocs\u002Fcapabilities\u002Fpreview-and-analysis","Preview and analysis",{"path":666,"title":667},"\u002Fdocs\u002Fcapabilities\u002Fask-your-data","Ask your data with AI",{"path":669,"title":670},"\u002Fdocs\u002Fcapabilities\u002Freports","Pixel-perfect reports",{"path":672,"title":673},"\u002Fdocs\u002Fcapabilities\u002Freport-functions","Report functions",{"path":675,"title":676},"\u002Fdocs\u002Fcapabilities\u002Fdashboards","Dashboards",{"path":678,"title":679},"\u002Fdocs\u002Fscripting","Python and R",{"path":681,"title":682},"\u002Fdocs\u002Fsql-scripts","SQL scripts",{"path":684,"title":685},"\u002Fdocs\u002Fcapabilities\u002Fnotebooks","marimo notebooks as apps",{"path":687,"title":688},"\u002Fdocs\u002Fcontainer-node","Docker images in flows",{"path":690,"title":691},"\u002Fdocs\u002Fcapabilities\u002Fflow-groups","Flow groups: orchestration",{"path":693,"title":694},"\u002Fdocs\u002Fcapabilities\u002Fscheduling","Scheduling",{"path":696,"title":697},"\u002Fdocs\u002Fpushmail","Pushmail: datasources, reports and dashboards by email",{"path":699,"title":700},"\u002Fdocs\u002Fplaceholders","Dynamic dates",{"path":702,"title":703},"\u002Fdocs\u002Fcapabilities\u002Fengines","Engines",{"path":705,"title":706},"\u002Fdocs\u002Fengines\u002Fengine-differences","Engine differences",{"title":708,"icon":709,"intro":710,"items":711},"Sources","sources","Every way data comes in: files, databases, buckets, SFTP folders, HTTP APIs, SharePoint, Google Sheets, and the results of your own flows.",[712,715,718,721,724,727,730,733,736],{"path":713,"title":714},"\u002Fdocs\u002Fsources","All sources",{"path":716,"title":717},"\u002Fdocs\u002Fsources\u002Ffiles","Uploaded files",{"path":719,"title":720},"\u002Fdocs\u002Fsources\u002Fdatabases","Database tables and queries",{"path":722,"title":723},"\u002Fdocs\u002Fs3-datasource","S3 buckets",{"path":725,"title":726},"\u002Fdocs\u002Fsftp","SFTP folders",{"path":728,"title":729},"\u002Fdocs\u002Fapi-datasource","HTTP APIs",{"path":731,"title":732},"\u002Fdocs\u002Fsources\u002Fsharepoint","Excel on SharePoint",{"path":734,"title":735},"\u002Fdocs\u002Fsources\u002Fgoogle-sheets","Google Sheets",{"path":737,"title":738},"\u002Fdocs\u002Fsources\u002Fflow-outputs","Results of flows and scripts",{"title":740,"icon":741,"intro":742,"items":743},"Connections","connections","The systems Tabularia reads from and writes to, how each connection is set up, and who may use it.",[744,747,750,753,756,758,759,761,762,765,768],{"path":745,"title":746},"\u002Fdocs\u002Fconnections","All connections",{"path":748,"title":749},"\u002Fdocs\u002Fconnections\u002Fdatabases","Databases",{"path":751,"title":752},"\u002Fdocs\u002Fsqlserver","Microsoft SQL Server driver",{"path":754,"title":755},"\u002Fdocs\u002Fconnections\u002Fs3","S3 and compatible storage",{"path":725,"title":757},"SFTP servers",{"path":728,"title":729},{"path":731,"title":760},"SharePoint",{"path":734,"title":735},{"path":763,"title":764},"\u002Fdocs\u002Fconnections\u002Fsmtp","SMTP email",{"path":766,"title":767},"\u002Fdocs\u002Fcontainer-registries","Container registries",{"path":769,"title":770},"\u002Fdocs\u002Fconnections\u002Fdestinations","Writing data out",{"title":30,"icon":772,"intro":773,"items":774},"integrations","How Tabularia fits your stack: AI providers, the REST API and webhooks, dbt, OpenLineage, single sign-on, SIEM and monitoring.",[775,777,780,783,786,789,792,793],{"path":29,"title":776},"All integrations",{"path":778,"title":779},"\u002Fdocs\u002Fintegrations\u002Fai","AI: where it is used",{"path":781,"title":782},"\u002Fdocs\u002Fapi","API, tokens and webhooks",{"path":784,"title":785},"\u002Fdocs\u002Fdbt-export","Export to dbt",{"path":787,"title":788},"\u002Fdocs\u002Fopenlineage","OpenLineage",{"path":790,"title":791},"\u002Fdocs\u002Fsso-keycloak","Single sign-on with Keycloak",{"path":627,"title":5},{"path":24,"title":25},{"title":795,"icon":796,"intro":797,"items":798},"Security & governance","governance","Who may see and do what, what is recorded, and how data quality and personal data are kept in check.",[799,802,805,808,811,814,817],{"path":800,"title":801},"\u002Fdocs\u002Fgovernance","Overview",{"path":803,"title":804},"\u002Fdocs\u002Fgovernance\u002Fpermissions","Permissions",{"path":806,"title":807},"\u002Fdocs\u002Fgovernance\u002Faudit-log","Audit log",{"path":809,"title":810},"\u002Fdocs\u002Fgovernance\u002Fdata-contracts","Data contracts",{"path":812,"title":813},"\u002Fdocs\u002Fdesign\u002Fsso-group-mapping","SSO and group mapping",{"path":815,"title":816},"\u002Fdocs\u002Fexamples\u002Fkeycloak","Keycloak example on a laptop",{"path":818,"title":819},"\u002Fdocs\u002Fengines\u002Fclickhouse-ai-user","A ClickHouse user for the AI assistant",{"title":821,"icon":822,"intro":823,"items":824},"Install & operate","operate","Run it in production on Kubernetes, configure it, upgrade it and keep it healthy.",[825,828,831,834,837,840,843],{"path":826,"title":827},"\u002Fdocs\u002Fdeploy\u002Fkubernetes","Kubernetes and Helm",{"path":829,"title":830},"\u002Fdocs\u002Fdeploy\u002Fkind","A company-like cluster on one computer (kind)",{"path":832,"title":833},"\u002Fdocs\u002Fdeploy\u002Fupgrading","Upgrading, backups and restore",{"path":835,"title":836},"\u002Fdocs\u002Fdeploy\u002Frelease-checklist","Install and upgrade checklist",{"path":838,"title":839},"\u002Fdocs\u002Fconfiguration","Configuration reference",{"path":841,"title":842},"\u002Fdocs\u002Fengine-settings","Settings from the panel",{"path":844,"title":845},"\u002Fdocs\u002Fdatabase-migrations","Database migrations",{"title":847,"icon":848,"intro":849,"items":850},"Reference","reference","Release process and the remaining reference pages.",[851],{"path":852,"title":853},"\u002Fdocs\u002Frelease-process","Release process",1793656371142]