diff --git a/applications/itd/splunk/package.nix b/applications/itd/splunk/package.nix
new file mode 100644
index 0000000..aa5db9c
--- /dev/null
+++ b/applications/itd/splunk/package.nix
@@ -0,0 +1,43 @@
+{
+  stdenv,
+  lib,
+  fetchurl,
+  #, alsa-lib
+  openssl,
+  zlib,
+  autoPatchelfHook,
+}:
+stdenv.mkDerivation rec {
+  pname = "splunk-forwarder";
+  version = "9.1.7";
+  version_long = "${version}-e17104057ef0";
+
+  src = fetchurl {
+    url = "https://download.splunk.com/products/universalforwarder/releases/${version}/linux/splunkforwarder-${version_long}-Linux-x86_64.tgz";
+    hash = "sha256-EWpfenEhExe5qDscqb7ZQUwahYgAgPQ+APLlweRQAoc=";
+  };
+
+  nativeBuildInputs = [autoPatchelfHook];
+
+  buildInputs = [
+    #    alsaLib
+    openssl
+    zlib
+  ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+    # gets unzipped and we just pop it all into teh output
+    # might add the patching of the path vars in the scripts to be here
+    cp -R ./splunkforwarder $out
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://splunk.com";
+    description = "Logging Service";
+    platforms = platforms.linux;
+  };
+}