Splunk Platform

Connect Splunk Cloud Platform or Splunk Enterprise to CloudThinker for read-only SPL searches, index review, and saved search inspection

Connect your Splunk deployment to let Alex (Cloud Engineer) run bounded searches in SPL, Splunk’s search language, over a time range; list your indexes and their event counts; and inspect saved searches, their schedules, and their alert actions.

The connection is read-only and reaches Splunk on its management port with an authentication token.

Supported platforms

Platform	What it needs
Splunk Cloud Platform	The management port opened to CloudThinker; it is closed to everyone by default
Splunk Enterprise	The management port reachable from CloudThinker, and TLS enabled, which token authentication requires

Free trial Splunk Cloud Platform accounts cannot use the REST API, so this connection cannot reach them. No setting in your deployment changes it.

Prerequisites

• A Splunk Cloud Platform deployment or a Splunk Enterprise instance.
• Token authentication turned on — Splunk ships it off.
• An administrator, or any user holding a role that can issue tokens to others.
• A Splunk user for CloudThinker whose roles reach only the indexes you want read.

Setup

1. Splunk Cloud Platform: open the management port to CloudThinker

   Splunk closes the search head API allow list to every address by default. Go to Settings → Server settings → IP allow list, open the Search head API access tab, click Add IP subnet, and add CloudThinker’s egress IP addresses in CIDR notation. Click Save; changes can take 15 minutes or more to propagate.

   This page needs Splunk Cloud Platform 8.2.2201 or higher and a role with the edit_ip_allow_list capability, which sc_admin has by default. On an older deployment, open a case in the Splunk Support Portal with the same addresses instead.

2. Turn on token authentication

   Go to Settings → Tokens. If it reads Token authentication is currently disabled, click Enable Token Authentication. It applies immediately, with no restart. On Splunk Enterprise this also needs TLS enabled and the app key value store running, the default on a search head.

3. Create the token

   Still on Settings → Tokens, click New Token. Enter the CloudThinker user in User and a short description in Audience. Set an Expiration — left blank, Splunk applies your deployment’s global default, 30 days unless an administrator changed it.

   Click Create, then copy the whole Token field before closing the dialog. Splunk shows a token once.

4. Connect in CloudThinker

   Go to Connections → Splunk Platform and enter the token, the management port, and your management host: <deployment-name>.splunkcloud.com on Splunk Cloud Platform, or your instance’s hostname. Leave TLS certificate on Verify TLS certificate.

   Click Connect. CloudThinker reads your server info and reports Connected with the Splunk product and version it found.

Connection details

Field	Description	Example
Management host	Hostname only, with no scheme, port, path, or credentials	acme.splunkcloud.com
Management port	Splunk’s management port	8089
Authentication token	The token you created, issued to the CloudThinker user	—
TLS certificate	Whether to verify the certificate Splunk presents	Verify TLS certificate

The management port is not the port you browse to: Splunk Web defaults to 8000 and the management port to 8089. Point this connection at 8000 and Splunk answers with a web page instead of a clean error.

A token works only on the instance that issued it, except across the nodes of a search head cluster.

Required permissions

The token authenticates as the Splunk user it was issued to, so that user’s roles decide everything the connection can reach. Issue it to a user created for CloudThinker rather than a person’s account.

Grant	Why
A role with the search capability	Lets the user run a search using SPL; the default user, power, admin, and sc_admin roles all carry it
Only the indexes you want read	A Splunk role sets which indexes a user can search — this is the control that decides what agents can see

Start from the narrowest role that carries search and widen only if you have to.

Splunk’s search endpoint runs whatever SPL the token’s roles permit, including SPL that writes. CloudThinker refuses those commands before sending them, but that refusal lives in CloudThinker. The durable boundary is the role: restrict the token’s user to the indexes it should read, and to no capability beyond searching them.

Agent capabilities

Once connected, Alex can:

Capability	Description
Deployment overview	Report the Splunk product, version, and license state, and the roles this connection works under
Index review	List indexes with their event counts, and name the ones holding nothing
Log search	Run an SPL search over a time window and return a bounded sample of the matches
Aggregation	Answer a question about shape, such as a count grouped by host or sourcetype
Saved searches	List saved searches with their schedules, and flag ones that are disabled but still scheduled, or that notify nothing

Searches are bounded: the window defaults to 24 hours and reaches back at most 90 days, rows are capped, and each search runs under a time budget. Agents report the window and limits they used, and say when a search was cut short rather than presenting a partial result as a total.

Verify the connection

@alex #report my Splunk deployment: product and version, the indexes this connection can read with their event counts, and the roles it is working under

Example prompts

@alex #report 5xx errors from the api service in Splunk over the last 6 hours
@alex #report the noisiest Splunk sourcetypes by event count over the last 24 hours
@alex #report which Splunk saved searches are scheduled but disabled

Troubleshooting

Splunk rejected the token

The token value is wrong, or token authentication is off. Check the value, then check Settings → Tokens for the disabled message. A rejected token never means the deployment is empty.

The token is valid, but its roles cannot read the server info endpoint

The user’s roles are too narrow for that endpoint. Issue the token to a user with a search-capable role, and if that is still refused, widen the role a step at a time — Splunk publishes no single capability requirement for this endpoint.

Nothing answered, or the answer was not Splunk's server info

On Splunk Cloud Platform, nothing answering is expected before CloudThinker is on the search head API allow list — add the addresses and allow time to propagate. On Splunk Enterprise, check the host, the port, and any firewall between them. An answer that is not server info usually means the web port 8000 rather than the management port, or a proxy in front. A host field rejected outright carries a scheme, port, path, or credentials: enter the hostname alone.

The connection stopped working on its own

The token expired — 30 days by default when created without an expiration. Create a replacement with an explicit expiration and update the connection. A token also stops working if an administrator disables or deletes it, deletes the user, or turns token authentication off.

A search was refused before it ran

The SPL writes or sends data, or hides SPL that cannot be inspected. CloudThinker refuses commands such as | delete, | outputlookup, | collect, | script, and | sendemail, and shapes whose real SPL it cannot see, such as a macro or a nested search. Make the change in Splunk yourself rather than rewriting the query around the refusal.

Something you expected is missing, or a search returned nothing

Check what this token can reach before reading a result as absence: roles decide which indexes a user can search, so an excluded index never appears at all, and saved searches carry their own permissions. An index that appears with no events genuinely holds nothing. A search that times out establishes nothing — narrow the query, shorten the window, or group by a more specific field.

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• The role is the real boundary — restrict the token’s user to the indexes it should read; the connection’s refusals are a second line, not the first.
• Set an expiration and rotate it — Splunk shows a token once, and an expired token takes the connection down with no other warning.

Related

Graylog Connection

Read-only log search, cluster and stream inspection, and message count analysis

Elasticsearch Connection

Log analysis, index management, and search performance optimization