Splunk integration¶

Connecting Splunk lets DXDT run SPL searches and read your saved searches, indexes, apps, fired alerts, job results and system health. The integration is strictly read-only.


Setup time	~8 minutes
Difficulty	Moderate

Access required: An admin or role that can mint a token and grant read/search capability

Prerequisites¶

Your Splunk REST endpoint URL (management port, typically 8089, or Splunk Cloud stack URL)
Token authentication enabled on your Splunk instance

Setup¶

1. Determine your Splunk REST URL¶

For self-hosted Splunk the REST API is the management interface, e.g. https://splunk.example.com:8089. For Splunk Cloud use your stack's API host, e.g. https://<stack>.splunkcloud.com:8089.

Note

The host must be reachable from DXDT; open or allow-list the management port. Self-signed certificates are tolerated by the integration.

2. Create a least-privilege search role¶

In Settings > Roles, use or create a role limited to search on the indexes you want DXDT to read, without admin capabilities. Assign this role to the account you will mint the token for.

Note

Grant search/read only — DXDT never writes, deletes or changes Splunk configuration.

3. Enable and create an authentication token¶

Go to Settings > Tokens, ensure Token Authentication is enabled, then click New Token. Set the User to your least-privilege search account, add an audience/description, and set a sensible expiry.

Copy the token value; it is a long JWT-style string.
The token is sent as a Bearer token to the Splunk REST API.

Configuration fields¶

Field	Where to find it
Auth Token (`auth_token`)	A Splunk authentication token (or session key) for a search-only user. Sent as a Bearer token. Required.
Splunk URL (`splunk_url`)	Your REST/management endpoint, e.g. `https://splunk.example.com:8089` (self-hosted) or `https://<stack>.splunkcloud.com:8089` (Cloud). `https://` is added if omitted; trailing slashes are trimmed.

Verify the connection¶

Enter the token and URL in the Splunk plugin's Configuration tab and click Install & Configure; the Live Status panel should show a healthy connection to your Splunk instance.

Security

Your Splunk token and URL are stored encrypted per-tenant and are used only for read-only Splunk REST operations.

Troubleshooting¶

401 / Unauthorized

The token is invalid, expired, or token authentication is disabled. Enable Token Authentication and mint a fresh token for the search-only user.

Connection refused or timeout

Wrong port or the management interface is not reachable from DXDT. Use the management port (usually 8089) and allow-list DXDT's access to it.

Searches return no results despite healthy status

The token's role lacks search access to the target indexes. Grant the role search on the relevant indexes.

Vendor documentation: https://docs.splunk.com/Documentation/Splunk/latest/Security/CreateauthTokens