--- title: "Configure the Splunk data source | Grafana Enterprise Plugins documentation" description: "Configure the Splunk data source to connect Grafana to your Splunk instance." --- > For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt). # Configure the Splunk data source This document explains how to configure the Splunk data source in Grafana. ## Before you begin Before configuring the data source, ensure you have: - **Grafana permissions:** Organization administrator role. - **Splunk account:** A [Splunk account](https://www.splunk.com/en_us/sign-up.html) with credentials (username and password or an authentication token). - **Network access:** [Port 8089 enabled](https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ConfigureOutboundPorts) on your Splunk instance. ## Key concepts If you’re new to Splunk, these terms are used throughout the configuration: Expand table | Term | Description | |--------------------------|--------------------------------------------------------------------------------------------------| | **SPL** | Search Processing Language, the query language used by Splunk to search and analyze data. | | **Index** | A repository for Splunk data, similar to a database table. | | **Source type** | A classification for data ingested into Splunk that determines how data is formatted and parsed. | | **Namespace** | A Splunk app context that determines which knowledge objects are available to a query. | | **Authentication token** | A token-based alternative to username and password for authenticating to the Splunk REST API. | ## Add the data source To install the plugin, refer to [Install the Splunk data source](/docs/plugins/grafana-splunk-datasource/latest/install/). For general information on adding a data source, refer to [Add a data source](/docs/grafana/latest/administration/data-source-management/#add-a-data-source). To add the Splunk data source, complete the following steps: 1. Click **Connections** in the left-side menu. 2. Under **Connections**, click **Add new connection**. 3. Enter `Splunk` in the search bar. 4. Select **Splunk data source**. 5. Click **Add new data source** in the upper right. You are taken to the **Settings** tab where you set up your Splunk configuration. ## Configuration options The following sections describe the available configuration options. ### General settings Expand table | Setting | Description | |-------------|-------------------------------------------------------------------------------------------------------------------------------| | **Name** | The data source name. This is how you refer to the data source in panels and queries. For example: `Splunk-1`, `Splunk_data`. | | **Default** | Toggle to make this the default data source for new panels. | ### Connection settings Expand table | Setting | Description | |---------|-------------------------------------------------------------------------------------------------------------------------------------------------| | **URL** | The URL of your Splunk server, including the management port. For example: `http://localhost:8089` or `https://splunk-server.example.com:8089`. | ## Authentication The data source supports multiple authentication methods. Choose the method that best fits your deployment. Expand table | Method | Best for | Requires feature toggle | |----------------------------|----------------------------------------------|-------------------------| | **Basic authentication** | Most deployments | No | | **Authentication token** | Token-based access without sharing passwords | No | | **Forward OAuth Identity** | User-level auth via OAuth | Yes | > Note > > Use TLS (Transport Layer Security) for an additional layer of security when working with Splunk. For information on setting up TLS encryption with Splunk, refer to [Securing Splunk Enterprise](https://docs.splunk.com/Documentation/Splunk/latest/Security/AboutsecuringyourSplunkconfigurationwithSSL). ### Basic authentication The most common authentication method. Use your Splunk username and password to connect. Avoid using the default administration account; create a dedicated user for Grafana with appropriate permissions. ### Authentication token Use an authentication token generated in Splunk instead of a username and password. Tokens let you provide access to environments without sharing standard credentials. To configure token authentication: 1. Generate a token in Splunk. Refer to the Splunk [Create authentication tokens](https://docs.splunk.com/Documentation/Splunk/latest/Security/CreateAuthTokens) documentation. 2. In the data source configuration, enter the token in the **Authentication token** field under **Alternative authentication**. ### Forward OAuth Identity Forward the logged-in user’s OAuth token to Splunk for authentication. This enables user-level authentication without requiring separate Splunk credentials. > Note > > Forward OAuth Identity is not enabled by default. For Grafana Cloud, contact Grafana Support to enable this feature. For self-managed Grafana Enterprise, enable the `splunkEnableOAuthForwarding` feature toggle in your Grafana configuration. ### TLS configuration The following TLS options are available: Expand table | Setting | Description | |-------------------------------------|--------------------------------------------------------------------------------------------------------------| | **Add self-signed certificate** | Upload a CA certificate for verifying self-signed TLS certificates. | | **TLS client authentication** | Toggle on to use mutual TLS. When enabled, provide the **Server name**, **Client cert**, and **Client key**. | | **Skip TLS certificate validation** | Toggle on to bypass TLS certificate validation. Not recommended for production environments. | ### Custom HTTP headers Add custom HTTP headers to all requests sent to the data source. This is useful for custom authentication or routing requirements. Expand table | Setting | Description | |------------|------------------------| | **Header** | The HTTP header name. | | **Value** | The HTTP header value. | ## Advanced options The advanced options are available under the **Additional settings** section in the data source configuration. ### Advanced HTTP settings Expand table | Setting | Description | Default | |---------------------|---------------------------------------------------------------------------------------------------------------------------------|------------------------------| | **Allowed cookies** | Specify cookies by name that should be forwarded to the data source. The Grafana proxy strips all forwarded cookies by default. | None | | **Timeout** | The HTTP request timeout in seconds. This is the Grafana HTTP transport-level timeout, separate from the query timeout. | Unset (uses Grafana default) | ### Query and performance options Expand table | Setting | Description | Default | |----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------| | **Results limit** | Maximum number of results returned from each data request. | No limit (backend safety cap: `10000`) | | **Preview mode** | Toggle on to get search results as they become available. Enables polling of the [`jobs/{search_id}/results_preview`](https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7D.2Fresults_preview) Splunk API endpoint. | Off | | **Async queries** | Toggle on to periodically check for query results instead of waiting for the full result set. | Off | | **Min poll interval** | Minimum polling interval in milliseconds when preview mode or asynchronous queries are enabled. | `500` | | **Max poll interval** | Maximum polling interval in milliseconds when preview mode or asynchronous queries are enabled. | `3000` | | **Auto cancel timeout** | Number of seconds a job can be inactive before Splunk automatically cancels it. Set to `0` to disable. | `30` | | **Timeout in seconds** | Plugin-level query timeout in seconds. Controls how long a query can run before it is cancelled. Minimum value is `1`. | `30` | | **Maximum status buckets** | Maximum number of timeline status buckets generated per query. Set to `0` to disable timelines. | `300` | | **Filter internal fields** | Toggle on to hide fields with names matching the internal field pattern. | Off | | **Internal field pattern** | Regex pattern for identifying internal fields to filter. Only visible when **Filter internal fields** is enabled. | `^_.+` | | **Timestamp field** | Field used by Grafana to determine event timestamps. Refer to [Timestamp and time ranges](https://docs.splunk.com/Documentation/SCS/current/Search/Timestampsandtimeranges) for more information. | `_time` | | **Default earliest time** | Earliest time for searches without a time range, such as template variable queries. | `-1hr` | ### Search mode There are two search mode settings: - **Fields search mode:** Sets the search mode for field queries. Options are `quick` and `full`. - **Variables search mode:** Sets the search mode for variable queries. Options: - `fast`: Turns field discovery off for event searches. No event or field data for stats searches. - `smart`: Turns field discovery on for event searches. No event or field data for stats searches. - `verbose`: Returns all event and field data. ### Secure Socks Proxy > Note > > This setting is only visible when the `secureSocksDSProxyEnabled` feature toggle is enabled in your Grafana configuration and you are running Grafana 10 or later. Toggle on to route data source traffic through a secure SOCKS proxy. ## Search Head Cluster configuration If your Splunk deployment uses a Search Head Cluster (SHC) behind a load balancer, additional configuration is required to ensure the data source works reliably. The Splunk plugin creates a search job and then issues follow-up requests to poll its status and retrieve results. All requests for a given search job must reach the same search head, because search job IDs (`sid`) are local to the search head that created them. ### Requirements 1. **Use token authentication or basic authentication.** Authentication tokens replicate across Search Head Cluster members, so any search head can validate a token. Basic authentication also works across members: Grafana sends the username and password on every HTTP request, rather than relying on a Splunk session cookie. Either method still requires sticky sessions, because search job IDs (`sid`) are local to the search head that created the job. 2. **Configure load balancer sticky sessions.** Set up session affinity (source IP or cookie-based) on the load balancer in front of your SHC. This ensures all requests from a single Grafana instance are routed to the same search head for the duration of a search job. Sticky sessions are especially important when **Async queries** or **Preview mode** is enabled, because these modes issue multiple polling requests per query. 3. **Point the data source URL at the load balancer.** Enter the load balancer address (for example, `https://splunk-lb.example.com:8089`) in the **URL** field, not the address of an individual search head. ### Provisioning example YAML ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```yaml apiVersion: 1 datasources: - name: Splunk (SHC) type: grafana-splunk-datasource access: proxy editable: true enabled: true jsonData: authType: custom-splunk fieldSearchType: quick variableSearchLevel: fast secureJsonData: authToken: url: https://splunk-lb.example.com:8089 ``` ### Grafana high availability If you run multiple Grafana instances (for example, in a Kubernetes deployment), each instance maintains its own connection to Splunk. Ensure the load balancer sticky session configuration accounts for traffic from multiple source IP addresses, one per Grafana replica. > Note > > During a rolling restart of the Search Head Cluster, some search heads enter Detention mode and reject new search jobs. This is expected and temporary. If you encounter “Detention mode” errors, refer to [Troubleshoot Splunk data source issues](/docs/plugins/grafana-splunk-datasource/latest/troubleshooting/#this-instance-is-currently-in-detention-mode-and-does-not-allow-running-new-search-jobs). ## Data links Data links allow you to associate data with other Grafana data sources or external URLs. They are commonly used in Explore mode. To set up a data link, click **+ Add** under the **Data links** header in data source settings. Expand table | Setting | Description | |-------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Field** | The exact field name or a regular expression pattern that matches the field name. | | **Label** | A meaningful label for the data link. | | **Regex** | A regular expression to parse and capture part of a log message. Wrap the expression in `//` and include one set of brackets for the matching group. To match everything, use `/(.*)/`. | | **URL** | Use `${__value.raw}` to reference the captured value. | | **Internal link** | Toggle on to link to another Grafana data source. Toggle off to link to an external URL. | Click **+ Add** to add multiple data links. Click the red **X** to remove a link. ## Verify the connection Click **Save & test** to verify the connection. On success, you see a message like: **Connected to Splunk version: “9.1.3” build: “d95b3bc7f6d0”** If the connection fails, refer to [Troubleshoot Splunk data source issues](/docs/plugins/grafana-splunk-datasource/latest/troubleshooting/). ## Provision the data source You can define and configure the Splunk data source in YAML files as part of the Grafana provisioning system. For more information about provisioning, refer to [Provision Grafana](/docs/grafana/latest/administration/provisioning/#data-sources). **Basic authentication example:** YAML ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```yaml apiVersion: 1 datasources: - name: Splunk type: grafana-splunk-datasource access: proxy basicAuth: true basicAuthUser: editable: true enabled: true jsonData: fieldSearchType: quick internalFieldsFiltration: true variableSearchLevel: fast previewMode: false maxResultCount: 999 secureJsonData: basicAuthPassword: url: ``` **Token authentication example:** YAML ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```yaml apiVersion: 1 datasources: - name: Splunk type: grafana-splunk-datasource access: proxy editable: true enabled: true jsonData: authType: custom-splunk fieldSearchType: quick variableSearchLevel: fast secureJsonData: authToken: url: ``` > Note > > When using token authentication in provisioning, you must set `authType: custom-splunk` in `jsonData`. Without this, the backend treats the configuration as basic authentication and ignores the `authToken` value. ## Set query results limit To improve performance, you can limit the number of returned results. When more than one positive limit is set, the lowest value is used. 1. The **Results limit** value in the data source configuration. A positive value is used as the limit. `0` applies the backend safety cap of `10000`. 2. The `GF_PLUGIN_GRAFANA_SPLUNK_DATASOURCE_MAX_RESULT_LIMIT` environment variable (self-managed only). When this variable and **Results limit** are both positive, the lower value is used. When **Results limit** is `0`, this variable replaces the `10000` safety cap. 3. The per-query **Limit** in the query editor. The plugin uses this value only when it is lower than the resolved data source limit and lower than `10000`. > Note > > Grafana Cloud does not support the `GF_PLUGIN_GRAFANA_SPLUNK_DATASOURCE_MAX_RESULT_LIMIT` environment variable. Use the **Results limit** setting in the data source configuration instead.