Documentation Plugins Splunk data source Installation

Install and upgrade the Splunk data source plugin

This document covers how to install, upgrade, and verify the Splunk data source plugin across different Grafana deployment environments. After the plugin is installed, refer to Configure the Splunk data source to set up a connection.

Before you begin

Verify the following requirements before installing:

Install the plugin

Choose the installation method that matches your Grafana deployment.

Grafana Cloud

Enterprise plugins must be activated for your organization before they appear as installable in the plugin catalog.

1. Go to grafana.com/orgs and sign in with your Grafana Cloud account.
2. Select your organization.
3. Navigate to the Plugins tab and verify that the Splunk plugin is activated. If it isn’t listed, confirm your Cloud plan includes Enterprise plugins.
4. In your Grafana Cloud instance, navigate to Administration > Plugins and data > Plugins.
5. Search for Splunk and click Install.

Self-managed Grafana (CLI)

Bash Copy

grafana cli plugins install grafana-splunk-datasource

Restart Grafana after installation:

Bash Copy

sudo systemctl restart grafana-server

Docker

Set the GF_INSTALL_PLUGINS environment variable:

YAML Copy

environment:
  - GF_INSTALL_PLUGINS=grafana-splunk-datasource
  - GF_ENTERPRISE_LICENSE_TEXT=<YOUR_LICENSE>

Kubernetes (Helm chart)

Add the plugin to your Helm values:

YAML Copy

plugins:
  - grafana-splunk-datasource

envFromSecret: grafana-license-secret

Or use the GF_INSTALL_PLUGINS environment variable in your deployment spec:

YAML Copy

env:
  - name: GF_INSTALL_PLUGINS
    value: "grafana-splunk-datasource"
  - name: GF_ENTERPRISE_LICENSE_TEXT
    valueFrom:
      secretKeyRef:
        name: grafana-license
        key: license.jwt

Kubernetes (init container)

If you don’t control the Helm chart (for example, on a shared platform cluster), use an init container to download the plugin before Grafana starts:

YAML Copy

initContainers:
  - name: install-plugins
    image: curlimages/curl:latest
    command:
      - sh
      - -c
      - |
        curl -sL https://grafana.com/api/plugins/grafana-splunk-datasource/versions/latest/download \
          -o /plugins/grafana-splunk-datasource.zip && \
        unzip /plugins/grafana-splunk-datasource.zip -d /plugins/
    volumeMounts:
      - name: plugins
        mountPath: /plugins

Mount the same volume at /var/lib/grafana/plugins in the Grafana container.

Air-gapped (offline) installation

For environments without internet access:

1. Download the plugin ZIP from your Grafana account portal on a machine with internet access.

2. Transfer the ZIP to the Grafana server.

3. Extract to the plugins directory:

   Bash Copy

   unzip grafana-splunk-datasource-<version>.linux_amd64.zip -d /var/lib/grafana/plugins/

4. Set ownership:

   Bash Copy

   chown -R grafana:grafana /var/lib/grafana/plugins/grafana-splunk-datasource

5. Restart Grafana.

Verify the installation

After installing, confirm the plugin is loaded:

1. Navigate to Administration > Plugins and data > Plugins.
2. Search for Splunk and verify the plugin appears with a status of Installed.
3. Navigate to Connections > Add new connection and search for Splunk to confirm it’s available as a data source.
4. If the plugin doesn’t appear, check the Grafana server logs for errors and refer to Troubleshoot installation issues.

Upgrade the plugin

Upgrade steps depend on your Grafana deployment environment.

Grafana Cloud

Plugins are automatically updated on Grafana Cloud. No manual action is required. If you experience issues after an automatic update, contact Grafana Support.

Self-managed Grafana

Self-managed instances do not receive automatic plugin updates. You are responsible for checking for and applying updates.

1. Update the plugin:

   Bash Copy

   grafana cli plugins update grafana-splunk-datasource

2. Restart Grafana.

3. Verify each data source connection with Save & test.

To install a specific version:

Bash Copy

grafana cli plugins install grafana-splunk-datasource <version>

For Docker or Kubernetes, append the version to the plugin name:

YAML Copy

environment:
  - GF_INSTALL_PLUGINS=grafana-splunk-datasource <version>

Roll back to a previous version

If an upgrade causes issues on a self-managed instance, pin a specific plugin version:

Bash Copy

grafana cli plugins install grafana-splunk-datasource 5.8.19

Restart Grafana after the rollback.

Check for updates

To check whether a newer version of the Splunk plugin is available:

1. Navigate to Administration > Plugins and data > Plugins.
2. Search for Splunk and open the plugin page.
3. If an update is available, an Update button appears.

You can also check the latest version programmatically:

Bash Copy

curl -s https://grafana.com/api/plugins/grafana-splunk-datasource | jq '.version'

To stay informed about new releases, monitor the Splunk plugin changelog or subscribe to release notifications through your Grafana account at grafana.com/orgs.

Plugin administration in self-managed environments

Installing, updating, and uninstalling plugins from the Grafana UI is controlled by the plugin_admin_enabled setting, which is true by default. If a Grafana administrator sets it to false, the Install and Update buttons don’t appear in the plugin catalog UI, even when the plugin is available. This is common in hardened or high-availability (HA) deployments, where UI-based plugin management is often disabled deliberately.

To re-enable UI-based plugin management, set plugin_admin_enabled to true in your Grafana configuration:

ini Copy

[plugins]
plugin_admin_enabled = true

If you manage plugins exclusively through the CLI, environment variables, or provisioning, you can leave this setting disabled.

Uninstall the plugin

To remove the Splunk plugin from a self-managed Grafana instance:

Bash Copy

grafana cli plugins remove grafana-splunk-datasource

Restart Grafana after uninstalling. Existing data source configurations are preserved in the Grafana database but become non-functional until the plugin is reinstalled.

For Docker or Kubernetes, remove grafana-splunk-datasource from the GF_INSTALL_PLUGINS variable and redeploy.

Troubleshoot installation issues

The following sections address common installation problems.

Plugin doesn’t appear in the catalog (Grafana Cloud)

Cause: The Enterprise plugin isn’t activated for your organization.

Solution:

1. Go to grafana.com/orgs.
2. Select your organization and navigate to the Plugins tab.
3. Verify that the Splunk plugin is listed and activated.
4. Confirm your Cloud plan is Pro or Advanced. Free and Starter plans don’t include Enterprise plugins.

“Plugin not found” or install button missing

Possible causes and solutions:

License key errors (self-managed)

Cause: The GF_ENTERPRISE_LICENSE_TEXT environment variable contains an invalid or malformed license key.

Solution:

1. Verify the license key doesn’t contain extra whitespace, line breaks, or truncated characters.
2. Confirm the key is for the correct Grafana instance URL.
3. Check that the license hasn’t expired at grafana.com/orgs.
4. For license activation help, refer to Activate an Enterprise license.

“Unsigned plugin” error (air-gapped installs)

Cause: The plugin ZIP is incomplete or was corrupted during transfer. Official downloads from grafana.com are always signed; this error means the signature file or plugin files are missing or damaged.

Solution:

1. Re-download the plugin ZIP from your Grafana account portal on a machine with internet access.
2. Verify the extracted directory contains MANIFEST.txt (the signature file) and that the folder name matches the plugin ID (grafana-splunk-datasource).
3. Ensure the architecture (linux_amd64, linux_arm64, darwin_amd64, etc.) matches your Grafana server.
4. Re-extract the full ZIP to /var/lib/grafana/plugins/, replacing the previous incomplete copy.
5. Set ownership: chown -R grafana:grafana /var/lib/grafana/plugins/grafana-splunk-datasource.
6. Restart Grafana.