Splunk Platform

Connect Splunk Cloud Platform or Splunk Enterprise so CloudThinker can run read-only SPL searches and review indexes and saved searches

Connect Splunk so CloudThinker can run bounded searches in SPL (Splunk’s search language), list your indexes with their event counts, and check saved searches and their alerts. The connection is read-only and calls Splunk’s REST API on the management port with an authentication token.

Supported platforms

Platform	What it needs
Splunk Cloud Platform	The management port opened to CloudThinker. Splunk Cloud closes it to everyone by default.
Splunk Enterprise	The management port reachable from CloudThinker, and TLS turned on, which token authentication requires

Splunk Cloud Platform free trial accounts can’t use the REST API, so this connection can’t reach them.

Prerequisites

• A Splunk Cloud Platform deployment or a Splunk Enterprise instance.
• A Splunk admin, or a user whose role can create tokens for other users.
• A Splunk user created for CloudThinker, with a role that reaches only the indexes you want searched. See Required permissions.
• The Admin role in the CloudThinker workspace, which you need to add connections. See Roles.

Setup

1. Splunk Cloud Platform only: allow CloudThinker on the management port

   Go to Settings → Server settings → IP allow list, open the Search head API access tab, and click Add IP subnet. Add CloudThinker’s egress IP addresses in CIDR notation, then click Save. Changes can take 15 minutes or more to apply. These docs don’t publish CloudThinker’s egress IP list: ask your CloudThinker contact, or contact us.

   You need a role with the edit_ip_allow_list capability (sc_admin has it). On Splunk Enterprise, skip this step: allow inbound TCP on the management port (8089 by default) only from CloudThinker’s egress IPs.

2. Create a role and a user for CloudThinker

   Go to Settings → Roles and create a role with the search capability. Under its indexes, allow only the indexes CloudThinker should search.

   Don’t copy or inherit Splunk’s default user role without checking its indexes. It can search all non-internal indexes, which is wider than you probably want. Then go to Settings → Users, create a user for CloudThinker, and give it only that role.

3. Turn on token authentication

   Go to Settings → Tokens. If the page says Token authentication is currently disabled, click Enable Token Authentication. It takes effect right away, with no restart.

4. Create the token

   On Settings → Tokens, click New Token. Set User to the CloudThinker user, add a short Audience such as CloudThinker, and set an Expiration to a date you’ll track. Put a reminder in your calendar to rotate the token before then. Left blank, Splunk uses your deployment’s default (30 days unless an admin changed it), and the connection stops working when it lapses.

   Click Create and copy the full Token value before you close the dialog. Splunk shows it once.

5. Connect in CloudThinker

   In CloudThinker’s sidebar, click More → Workspace settings → Connections, stay on the Builtin Connections tab, and select Splunk Platform. Fill in the fields from the table below, keep TLS certificate on Verify TLS certificate, and click Connect. CloudThinker checks that the endpoint answers with Splunk’s server info.

   Success state: the connection shows a Connected status. If the check fails, hover the error icon on the connection to read why. Run the verify prompt below to see the product and version CloudThinker found.

Connection details

Field	What to enter	Example
Management host	Hostname or IP only, with no https://, port, or path. On Splunk Cloud Platform, use the stack’s management host, which is not always the host you sign in to.	acme.splunkcloud.com
Management port	Splunk’s management port. Defaults to 8089.	8089
Authentication token	The token you created for the CloudThinker user
TLS certificate	Verify TLS certificate for Splunk Cloud Platform and any instance with a trusted certificate. Skip TLS verification only for a self-hosted instance still on Splunk’s default self-signed certificate. Skipping it means CloudThinker can’t detect an impostor server, so the token could be intercepted. Install a trusted certificate as the lasting fix.	Verify TLS certificate

Don’t use port 8000. That’s Splunk Web, the port you browse to. Pointed at 8000, the connection gets a web page back instead of Splunk’s API, and the check fails.

Required permissions

The token acts as the Splunk user it was issued to, so that user’s roles decide what CloudThinker can search. Issue it to a dedicated CloudThinker user, never to a person’s account or an admin.

Grant	Why
A role with the search capability	Lets the user run SPL searches. Splunk’s default user role has it.
Only the indexes you want searched	The role’s allowed indexes are what CloudThinker can see. An index outside the role never appears.

Start from the narrowest role that has search and add indexes one at a time. Splunk’s search endpoint runs any SPL the role permits, including SPL that writes. CloudThinker blocks those commands before sending them, but the role is the boundary you control.

Agent capabilities

Capability	What CloudThinker does
Deployment overview	Reports the Splunk product, version, license state, and the roles the token works under
Index review	Lists indexes with event counts and names the ones that are empty
Log search	Runs an SPL search over a time window and returns a capped sample of matches with the true match count
Aggregation	Answers shape questions, such as a count grouped by host or sourcetype
Saved searches	Lists saved searches and schedules, and flags ones that are disabled but still scheduled, or that send no alert

Searches default to the last 24 hours and reach back at most 90 days. Each search has a row cap and a time budget. CloudThinker tells you the window it used, and says so when a search timed out instead of reporting zero results.

CloudThinker refuses SPL that writes or sends data, such as | delete, | outputlookup, | collect, | script, and | sendemail. It also refuses SPL it can’t inspect: macros, map, savedsearch, unclosed quotes, and $...$ substitutions.

Verify the connection

Show my Splunk deployment: product and version, the indexes this connection can search with their event counts, and the roles it uses

Example prompts

Find 5xx errors from the api service in Splunk over the last 6 hours
Which Splunk sourcetypes had the most events in the last 24 hours?
Which Splunk saved searches are scheduled but disabled?

Troubleshooting

Splunk rejected the token (401)

The token is wrong, expired, or token authentication is off. Check the value, then look for the disabled message on Settings → Tokens.

The check says the endpoint answered, but not with Splunk's server info

You’re on the web port or behind a proxy. Set Management port to 8089 (or your custom management port) and point Management host straight at Splunk.

The check can't reach Splunk

On Splunk Cloud Platform, CloudThinker isn’t on the Search head API access allow list yet, or the change hasn’t applied. Wait 15 minutes after saving. On Splunk Enterprise, check the host, port, and firewall. If the instance uses Splunk’s default self-signed certificate, set TLS certificate to Skip TLS verification.

The host field is rejected

Management host contains a scheme, port, path, or credentials. Enter the hostname or IP alone.

The connection stopped working on its own

The token expired, which happens after 30 days by default. Create a new token with an explicit expiration and update the connection. A token also stops working if an admin disables it, deletes the user, or turns token authentication off.

A search was refused before it ran

The SPL writes, sends data, or hides SPL CloudThinker can’t inspect. Make the change in Splunk yourself. CloudThinker won’t rewrite the query to get around the block.

An index is missing, or a search returned nothing

The token’s role may not include that index, so it never appears. Check the roles in the verify prompt’s answer. A search that timed out tells you nothing: shorten the window or group by a more specific field.

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• The role is the real boundary: limit the token’s user to the indexes it should search. CloudThinker’s command blocking is a second line of defense.
• Set an expiration and rotate: an expired token takes the connection down without other warning, so put the rotation date in your calendar.

Related

Splunk Observability Connection

Read APM service health, traces, and metrics in Splunk Observability Cloud

Graylog Connection

Run read-only log searches in Graylog