# Splunk Enterprise (On-prem)

![Splunk-logo.svg](https://assets.relyanceuat.xyz/images/docs/27131247251725/27131247245453.svg)
Splunk is a software platform that indexes and correlates information in a container that makes it easy to search and monitor. It allows organizations to search, analyze and visualize the machine-generated data gathered from the websites, applications, sensors, devices etc.

In order to integrate Splunk with Relyance AI you will need your **Splunk Url**, **Port**, and either an **API Key*** or ***Username / Password**.

Depending on your Splunk instance, you may need to add the Relyance NAT gateway IP addresses from the article

Relyance AI IP Addresses for Allow Lists in the IP allowlist.

#### In Splunk:

1. Login to your Splunk account.
2. You'll find the **Splunk URL** in your browser's address bar.
3. The **Port** is the port used for your *Splunk Search Heads*. This is typically port 8089. **Obtain credentials**
4. There are 2 methods to connect to Splunk Enterprise:
    - Using an account with a **Username** and **Password**. If following this method, it is recommended to use a service account with read-only permissions. Once you have your **Username** and **Password**, continue configuring the integration in [Relyance](#h_01HS9295YY61899X12T04PAWES).
    - Using a Splunk API Token ( **API KEY** ). Follow the directions on this page to create a Splunk Authentication token: [https://docs.splunk.com/Documentation/Splunk/latest/Security/CreateAuthTokens](https://docs.splunk.com/Documentation/Splunk/latest/Security/CreateAuthTokens)

#### In the Relyance AI application:

1. Login to your Relyance account.
2. Navigate to the **Settings** Menu in the bottom left-hand side.
3. Select **Integrations**.
4. Find the **Splunk Enterprise (On-Prem)** integration card and click it to open its connections.
5. On the **Authentication** step, pick the method under **Authentication Method**.

    The **Authentication** step asks for:

    - Using **API Key** —
        - **Host**: Host used for Splunk Enterprise; required.
        - **Port**: Port Used for Splunk Enterprise; required.
        - **API key**: Token; optional; held as a secret.
    - Using **User / Password** —
        - **Host**: Host used for Splunk Enterprise; required.
        - **Port**: Port Used for Splunk Enterprise; required.
        - **User**: Port Used for Splunk Enterprise; required.
        - **Password**: Password; optional; held as a secret.
6. Choose either **API Key** or **User / Password** from the drop-down menu.

![Splunk_Ent-1.png](https://assets.relyanceuat.xyz/images/docs/27131247251725/27132742189069.png)

![Splunk_Ent-2.png](https://assets.relyanceuat.xyz/images/docs/27131247251725/27132742211597.png)

7. Paste the required values into their respective fields.
8. To discover vendors automatically in your Splunk instance, check the **Enable Vendor Discovery** checkbox.
9. Check the **Enable Data Inspection** checkbox to do a deeper data discovery.
10. Click **Connect.**
11. At this point, you should see the following result on the Integrations page:

![Splunk_Ent-3.png](https://assets.relyanceuat.xyz/images/docs/27131247251725/27132348847757.png)

12. Congratulations, you are now connected to **Splunk Enterprise (On-prem)**.

<!-- failure-modes:begin (generated from the integration catalog; do not hand-edit) -->

## If the connection reports Connected but returns nothing

These are the ways this integration comes back empty without reporting an error. Generated from the integration catalog, so it tracks what the connection actually asks for.

1. **A credential rotated at the vendor is not picked up here.** **API key** and **Password** are stored when you save the connection, so regenerating the value at the vendor breaks the next scan until it is re-pasted here. Recording the expiry on the connection means Relyance warns you before it lapses.
2. **Check the address fields before suspecting the credentials.** **Host** identifies which tenant, region or host to talk to. A wrong value there fails authentication and looks exactly like a bad secret.

<!-- failure-modes:end -->

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

### Access token

```hcl
resource "relyance_integration_connection" "splunk_enterprise_0" {
  vendor = "splunk_enterprise"
  name   = "<your connection name>"

  auth = {
    method = "access-token"
    params = {
      host = "<host>"
      port = "8089"
      data_storage_location = "us"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      token = var.splunk_enterprise_token
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

### User / Password

```hcl
resource "relyance_integration_connection" "splunk_enterprise_1" {
  vendor = "splunk_enterprise"
  name   = "<your connection name>"

  auth = {
    method = "user-password"
    params = {
      host = "<host>"
      port = "8089"
      user = "<user>"
      data_storage_location = "us"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      pw = var.splunk_enterprise_pw
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

<!-- terraform-examples:end -->