Skip to main content

Splunk

Updated

Connect Qevlar to Splunk Cloud to investigate Splunk-forwarded endpoint, identity, and network events by running SPL searches. This page lists the permissions Qevlar requires and how to grant them.

Overview

Qevlar authenticates to Splunk's REST API using either a Bearer token or a username and password — no user sign-in per request. Access is governed by the role assigned to the account or token owner. The connector is read-only: it runs SPL searches and reads saved-search definitions.

API Purpose Auth
Splunk REST API (port 8089) Run SPL searches and read saved-search definitions Bearer token or Basic auth

The API base is https://{host}:8089 — Qevlar adds the scheme and port to the host you provide.

Connection details

Enter these values when configuring the connector in Qevlar. Choose one authentication method.

Field Where to find it Required
Host Your Splunk deployment hostname, e.g. <deployment>.splunkcloud.com Yes
API Token Settings → Tokens (Bearer authentication token) Token method
Username + Password A Splunk account's credentials Account method

Enter the Host as the hostname only — without https:// or the :8089 port.

Required permissions

Splunk authorizes through the role assigned to the account or token owner. The account needs a read-only role with:

Requirement Detail
search capability Run searches through the REST API
Index access Read access to the indexes holding the data you want investigated (set in the role's allowed indexes)
REST API access The REST API on port 8089 must be reachable from Qevlar

The built-in user role (extended with access to the relevant indexes) is sufficient. No admin or write capabilities are required.

On Splunk Cloud, also: enable token authentication for the stack (Settings → Tokens), and add Qevlar's egress IPs to the Splunk Cloud IP allow list so the REST API on port 8089 is reachable.

Reference: Access requirements and limitations for the Splunk Cloud Platform REST API.

Setup

  1. Choose or create a service account. Settings → Users → New User, or use an existing dedicated account.
  2. Assign a role. Give it the search capability and read access to the indexes Qevlar should query. No admin or write capabilities are needed.
  3. Choose an authentication method. Either generate a Bearer token (Settings → Tokens → New Token for the account, copied once) or use the account's username and password.
  4. For Splunk Cloud, open access. Enable token authentication for the stack and add Qevlar's egress IPs to the IP allow list so port 8089 is reachable.
  5. Get the host. Use your Splunk deployment hostname, e.g. <deployment>.splunkcloud.com.
  6. Configure the connector. In Qevlar, add the Splunk connector and enter the connection details above.

Verify the connection

After saving, Qevlar runs a health check that reads server info. If it fails, check, in order:

  1. The Host is correct and the REST API on port 8089 is reachable from Qevlar (on Splunk Cloud, confirm the IP allow list).
  2. The token is valid and token authentication is enabled, or the username and password are correct.
  3. The role has the search capability and access to the target indexes.

API reference

Operation HTTP Endpoint
Server info (health check) GET {host}:8089/services/server/info
Run search POST {host}:8089/services/search/v2/jobs
Read saved search GET {host}:8089/servicesNS/-/-/saved/searches/{name}

Auth header: Authorization: Bearer <token> or Authorization: Basic <base64(username:password)>.

Related articles