Splunk

The Splunk tool gives a workbench read-only access to logs already stored in Splunk Enterprise or Splunk Cloud. It searches that data through the Splunk management REST API and does not ingest logs or install a forwarder. The agent uses SPL (Splunk Processing Language) to query logs and can retrieve individual log events or aggregate log counts over time.

Prerequisites

Before you begin, make sure you have:

• A Splunk Enterprise search head or Splunk Cloud deployment that is already indexing the logs you want the workbench to query.
• Permission in Plural Console to create a configured tool and edit the target workbench.
• The Splunk management REST API base URL (port 8089, not the Splunk Web port).
• A dedicated Splunk user with appropriate capabilities and index access (see below).
• Authentication credentials: either a JWT authentication token (recommended), a Splunk session key, or username and password.
• An existing workbench, or permission to create one. See Setting up a workbench.

Find the management REST API base URL

The Splunk integration calls the management port, not the Splunk Web UI. Use HTTPS and port 8089 by default. Do not use Splunk Web port 8000 or HTTP Event Collector (HEC) port 8088.

Splunk Cloud Platform

1. Log in to Splunk Web.
2. Copy the hostname from the browser address bar (for example acme.splunkcloud.com). Ignore everything after the hostname.
3. The management REST API base URL is https://<hostname>:8089.

Port 8089 is often closed until you allowlist the caller using the Admin Config Service search-api IP allow list, or open a Splunk support case to enable REST API access.