Splunk Enterprise: Connecting to IPaaS

This guide explains how to set up a connection between iPaaS and the Splunk Enterprise REST API.

Connector Accessibility Prerequisites

Splunk Enterprise can be deployed either as an on‑premises instance or as a hosted service via Splunk Enterprise Cloud. API access varies by deployment type and license level:

• On‑premises instances with a license above the free tier have full access to the Splunk REST API.
• Splunk Cloud instances are limited to the Create a Search Job and Get a Search Job actions.

Splunk Enterprise supports self‑signed certificates for managing on‑premises instances. However, to use this connector without additional Splunk Cloud services, the Splunk instance must:

• Use a valid CA‑signed certificate, and
• Be publicly accessible (for example, a Splunk AMI hosted on AWS) or be reachable on the same network as an iPaaS proxy instance.

Customers subscribed to Splunk Observability Cloud must use a separate connector. Note: Complete integrations of Splunk with TDX and IPaaS require Splunk Observability Cloud to access the full scope of actions, some customers may require the additional direct Splunk Enterprise actions in this Connector

Connector Setup

Complete the following steps to connect iPaaS to Splunk Enterprise:

• Step 1: Create an API token in Splunk
• Step 2: Create a connector definition in iPaaS
• Step 3: Create credentials in iPaaS

Step 1: Create an API Token in Splunk

If the prerequisites are met, you must generate an API token to connect to the Splunk REST API. For detailed guidance, see the Splunk documentation: REST API Reference .

1. Log in to Splunk Enterprise as an administrator.
2. Navigate to Settings and select the Tokens tab.
3. Click New Token.
4. Provide the User, Audience, and an expiration time-frame.
5. Click Create, then copy and store the token securely. The token is only displayed once.

Step 2: Create a Connector Definition in iPaaS

1. From the top menu, go to Administration > Connector Definitions.
2. Click Add in the upper‑right corner.
3. Select Standard as the connector type, then click Next.
4. In the Add Standard Connector search box, enter Splunk Enterprise.
5. Select the Splunk Enterprise connector and click Next.
6. Click Add Connector.
7. Open the Configuration tab.
8. Under Variables, configure splunk:
   • On‑premises Splunk Enterprise: Use the instance IP address or hostname and include :8089 for the API port (for example, my.splunkinstance.web:8089). Note: Some endpoints such as the /services/collector/ actions may have different ports configured by default, these can be customized in Splunk.
   • Splunk Enterprise Cloud: Use the Splunk‑provided cloud domain URL.

Step 3: Create Credentials in iPaaS

1. Choose where to create the credential:
   • Shared credentials
     1. From the connector Configuration page, check Override and click Add.
     2. Or, go to Administration > Shared Credentials and add a credential of type Splunk Enterprise.
   • Application‑specific credentials
     1. Open the target application.
     2. Add a connector step to a flow, check Override, and click the + icon.
     3. Or, from the application menu, go to Credentials and add a credential of type Splunk Enterprise.
2. Enter the following values:
   • Name: A descriptive name for the Splunk Enterprise instance.
     • Example: Splunk Enterprise Cloud
   • Description: [System] credential created by [Name]
     • Example: Splunk Enterprise Cloud credential created by Alex T
   • Authentication Method: Splunk Enterprise
   • Authorization: Bearer <Splunk Enterprise Token> (the Bearer prefix is required)
3. Click Add New.

Additional Resources

For more information about the Splunk Enterprise API, see the official documentation: REST API Reference .