> ## Documentation Index > Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt > Use this file to discover all available pages before exploring further. # Splunk Platform > Connect Splunk Cloud Platform or Splunk Enterprise to CloudThinker for read-only SPL searches, index review, and saved search inspection Connect your Splunk deployment to let [Alex](/guide/agents/alex) (Cloud Engineer) run bounded searches in SPL, Splunk's search language, over a time range; list your indexes and their event counts; and inspect saved searches, their schedules, and their alert actions. The connection is **read-only** and reaches Splunk on its management port with an authentication token. ## Supported platforms | Platform | What it needs | | ------------------------- | ----------------------------------------------------------------------------------------------------- | | **Splunk Cloud Platform** | The management port opened to CloudThinker; it is closed to everyone by default | | **Splunk Enterprise** | The management port reachable from CloudThinker, and TLS enabled, which token authentication requires | Free trial Splunk Cloud Platform accounts cannot use the REST API, so this connection cannot reach them. No setting in your deployment changes it. ## Prerequisites * A **Splunk Cloud Platform** deployment or a **Splunk Enterprise** instance. * **Token authentication turned on** — Splunk ships it off. * An **administrator**, or any user holding a role that can issue tokens to others. * A **Splunk user for CloudThinker** whose roles reach only the indexes you want read. ## Setup Splunk closes the search head API allow list to every address by default. Go to **Settings → Server settings → IP allow list**, open the **Search head API access** tab, click **Add IP subnet**, and add CloudThinker's egress IP addresses in CIDR notation. Click **Save**; changes can take 15 minutes or more to propagate. This page needs Splunk Cloud Platform 8.2.2201 or higher and a role with the `edit_ip_allow_list` capability, which `sc_admin` has by default. On an older deployment, open a case in the Splunk Support Portal with the same addresses instead. Go to **Settings → Tokens**. If it reads `Token authentication is currently disabled`, click **Enable Token Authentication**. It applies immediately, with no restart. On Splunk Enterprise this also needs TLS enabled and the app key value store running, the default on a search head. Still on **Settings → Tokens**, click **New Token**. Enter the CloudThinker user in **User** and a short description in **Audience**. Set an **Expiration** — left blank, Splunk applies your deployment's global default, 30 days unless an administrator changed it. Click **Create**, then copy the whole **Token** field before closing the dialog. Splunk shows a token once. Go to **Connections → Splunk Platform** and enter the token, the management port, and your management host: `.splunkcloud.com` on Splunk Cloud Platform, or your instance's hostname. Leave **TLS certificate** on **Verify TLS certificate**. Click **Connect**. CloudThinker reads your server info and reports **Connected** with the Splunk product and version it found. ## Connection details | Field | Description | Example | | ------------------------ | --------------------------------------------------------- | ---------------------- | | **Management host** | Hostname only, with no scheme, port, path, or credentials | `acme.splunkcloud.com` | | **Management port** | Splunk's management port | `8089` | | **Authentication token** | The token you created, issued to the CloudThinker user | — | | **TLS certificate** | Whether to verify the certificate Splunk presents | Verify TLS certificate | The management port is not the port you browse to: Splunk Web defaults to **8000** and the management port to **8089**. Point this connection at 8000 and Splunk answers with a web page instead of a clean error. A token works only on the instance that issued it, except across the nodes of a search head cluster. ## Required permissions The token authenticates as the Splunk user it was issued to, so that user's roles decide everything the connection can reach. Issue it to a user created for CloudThinker rather than a person's account. | Grant | Why | | --------------------------------------- | ------------------------------------------------------------------------------------------------------------- | | A role with the **`search`** capability | Lets the user run a search using SPL; the default `user`, `power`, `admin`, and `sc_admin` roles all carry it | | **Only the indexes you want read** | A Splunk role sets which indexes a user can search — this is the control that decides what agents can see | Start from the narrowest role that carries `search` and widen only if you have to. Splunk's search endpoint runs whatever SPL the token's roles permit, including SPL that writes. CloudThinker refuses those commands before sending them, but that refusal lives in CloudThinker. The durable boundary is the role: restrict the token's user to the indexes it should read, and to no capability beyond searching them. ## Agent capabilities Once connected, Alex can: | Capability | Description | | ----------------------- | --------------------------------------------------------------------------------------------------------------------- | | **Deployment overview** | Report the Splunk product, version, and license state, and the roles this connection works under | | **Index review** | List indexes with their event counts, and name the ones holding nothing | | **Log search** | Run an SPL search over a time window and return a bounded sample of the matches | | **Aggregation** | Answer a question about shape, such as a count grouped by host or sourcetype | | **Saved searches** | List saved searches with their schedules, and flag ones that are disabled but still scheduled, or that notify nothing | Searches are bounded: the window defaults to 24 hours and reaches back at most 90 days, rows are capped, and each search runs under a time budget. Agents report the window and limits they used, and say when a search was cut short rather than presenting a partial result as a total. ### Verify the connection ```text theme={null} @alex #report my Splunk deployment: product and version, the indexes this connection can read with their event counts, and the roles it is working under ``` ### Example prompts ```text theme={null} @alex #report 5xx errors from the api service in Splunk over the last 6 hours @alex #report the noisiest Splunk sourcetypes by event count over the last 24 hours @alex #report which Splunk saved searches are scheduled but disabled ``` ## Troubleshooting The token value is wrong, or token authentication is off. Check the value, then check **Settings → Tokens** for the disabled message. A rejected token never means the deployment is empty. The user's roles are too narrow for that endpoint. Issue the token to a user with a search-capable role, and if that is still refused, widen the role a step at a time — Splunk publishes no single capability requirement for this endpoint. On Splunk Cloud Platform, nothing answering is expected before CloudThinker is on the search head API allow list — add the addresses and allow time to propagate. On Splunk Enterprise, check the host, the port, and any firewall between them. An answer that is not server info usually means the web port 8000 rather than the management port, or a proxy in front. A host field rejected outright carries a scheme, port, path, or credentials: enter the hostname alone. The token expired — 30 days by default when created without an expiration. Create a replacement with an explicit expiration and update the connection. A token also stops working if an administrator disables or deletes it, deletes the user, or turns token authentication off. The SPL writes or sends data, or hides SPL that cannot be inspected. CloudThinker refuses commands such as `| delete`, `| outputlookup`, `| collect`, `| script`, and `| sendemail`, and shapes whose real SPL it cannot see, such as a macro or a nested search. Make the change in Splunk yourself rather than rewriting the query around the refusal. Check what this token can reach before reading a result as absence: roles decide which indexes a user can search, so an excluded index never appears at all, and saved searches carry their own permissions. An index that appears with no events genuinely holds nothing. A search that times out establishes nothing — narrow the query, shorten the window, or group by a more specific field. ## Security * **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later. * **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection. * **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection. * **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves. - **The role is the real boundary** — restrict the token's user to the indexes it should read; the connection's refusals are a second line, not the first. - **Set an expiration and rotate it** — Splunk shows a token once, and an expired token takes the connection down with no other warning. ## Related Read-only log search, cluster and stream inspection, and message count analysis Log analysis, index management, and search performance optimization