Splunk

Splunk is a software platform that indexes and correlates information in a container that makes it easy to search and monitor. It allows organizations to search, analyze and visualize the machine-generated data gathered from the websites, applications, sensors, devices etc.

In order to integrate Splunk with Relyance AI you will need your Splunk Url, and API Key. You will also need to provide a Product name that your would associate with the integration analysis.

Depending on your Splunk instance, you may need to add the Relyance NAT IP addresses from the article

Relyance AI IP Addresses for Allow Lists to the allow list on the Splunk side.

In Splunk:

1. Login to your Splunk account.
2. Click on the General Settings tab.
3. The Splunk Url is referenced by the value of API tab under Endpoints and in the case below it is "https://api.us1.signalfx.com"

4. In order to generate the Api Key, click on the Access Tokens link at the bottom right corner.
5. Click on the New Token button.
6. Using the Pop up dialog box, create the new token and use that token as the API Key.

In the Relyance AI application:

1. Login to your Relyance AI account.
2. Navigate to the Settings (bottom-left corner).
3. Select Integrations.
4. Search and locate the Splunk integration card and click on it.
5. Click on the Add Connection button on the top right.
6. Provide a meaningful name for the integration and click on the Add button.
7. In the Overview section, select the integration features you wish to enable for the integration, review the Scope and Permission, and Endpoint details and click on Continue. For more details, seeIntegration Features.
8. In the Connection section, provide the appropriate values and click on Continue,
   1. Connection Name: This property allows you to update the integration specified in Step 6. If you have multiple integrations for the same vendor, you may want to assign distinct names to each. This helps streamline filtering by Discovery Source across the Inventory, Visual Maps, Assets, and Data Flow Analysis pages.
   2. Rescan Frequency: This property allows you to configure how often Relyance executes scans against this Vendor connection.
   3. Business Atlas Associations (required): the business entities or products that newly discovered third parties, services and assets from this integration are attributed to. Choose at least one from the Select Associations dropdown — the wizard will not advance past this step without one. For more details, see Business Atlas.
9. In the Authentication section, provide the following information retrieved from the Splunk section and click on Authenticate. - Account Details
10. Review the configuration summary from the Completion section and click on Finish.

11. Confirm the integration Status reflects Connected

Authentication methods and fields

Pick one of these under Authentication Method on the connection wizard's Authentication step. This table is generated from the integration catalog, so it always matches what the form actually asks for.

Manage this integration with Terraform

Connections for this integration can be managed as code with the Relyance Terraform provider. Non-secret fields go in auth.params; secret fields go in auth.secrets_wo, which is write-only — never stored in Terraform state. Rotate secrets by bumping auth.secrets_wo_version.

resource "relyance_integration_connection" "splunk" {
  vendor = "splunk"
  name   = "<your connection name>"

  auth = {
    method = "account-credentials"
    params = {
      accounts = jsonencode([
        {
          api-key = ""
          product = ""
          splunk-url = "https://api.us1.signalfx.com"
        }
      ])
      data_storage_location = "us"
    }
  }

  scans = { "property-inspection" = { enabled = true } }
}