Configure the Splunk Service

Configure Splunk as a service to search logs and context tables and run other Splunk actions.

Note the hostname of your Splunk API endpoint.
If you use a proxy, ensure that you whitelist the hostname of your Splunk API endpoint.

In the sidebar, click SETTINGS, then select Core.
Under SERVICE INTEGRATIONS, select Services.
Select a service:
- To configure a specific service, hover over a service, then click CONFIGURE. Use the search by vendor or filter by action to find a service.
- To manually provide the relevant information for a service, click Configure a new service.
- To view all actions for a service, hover over a service, then click the information icon .
Enter information about the service:
- Service Name – Enter a unique name for the service. By default, the service name is Splunk.
- (Optional) Description – Describe the service.
- (Optional) Owner – Enter the email address of the person or group responsible for the service.
- Host – Enter the hostname of your Splunk API endpoint.
- Admin Port – Enter 8089, the splunkd management port.
- Username – Enter the username for your Splunk account.
- Password – Enter the password to your Splunk account.
To validate the source, select TEST CONNECTIVITY.
Select CREATE SERVICE.

Cloud-delivered Incident ResponderIncident Responder Documentation