> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Splunk

> Connect Splunk Enterprise or Cloud to Myrmex over the REST API — mint an authentication token and add the integration.

import { Note, Steps, Step, CardGroup, Card, Tip } from '@mintlify/components';

Connect your **Splunk** search head (Enterprise or Cloud) so Myrmex can run SPL searches, triage Enterprise Security notable events, and browse your search catalog. Myrmex reaches Splunk over **HTTPS** on the management port (default `8089`) through a [Collector](/documentation/agent-endpoint-security/collector-mode) on your network. Every search runs **live, on demand** — Myrmex returns only what you ask for at that moment and copies or stores nothing from Splunk on its side. Credentials are resolved on your side and never pass through the model.

## What Myrmex Can Do

<CardGroup cols={2}>
  <Card title="Run SPL searches" icon="terminal">
    Execute one-shot SPL live, with a guard that blocks destructive commands.
  </Card>

  <Card title="Triage notable events" icon="triangle-exclamation">
    List, read, and update Enterprise Security notables to support [alert](/documentation/detection-response/alerts) triage.
  </Card>

  <Card title="Browse the search catalog" icon="list-check">
    Read the saved and correlation search catalog to understand your detections.
  </Card>

  <Card title="Enrich notables" icon="sitemap">
    Run one-shot enrichment on a notable to pull the context around it.
  </Card>
</CardGroup>

## Before You Start

* A **Collector** that can reach the Splunk **management/REST port** (default `8089`, HTTPS). On-prem it sits on the LAN; Splunk Cloud requires REST access (IP allow-list on port `8089`). See [Collector mode](/documentation/agent-endpoint-security/collector-mode).
* A **role** that can search the relevant indexes. For notable triage and updates it needs the Enterprise Security **ess\_analyst** role (capability `edit_notable_events`). Do not grant `can_delete`.
* For token auth: **Token Authentication** enabled (it is off by default on Splunk Enterprise).

## Step 1 — Create the Credential in Splunk

<Steps>
  <Step title="Option A — mint an authentication token (recommended)">
    Token authentication is disabled by default on Splunk Enterprise. In **Settings → Tokens**, enable **Token Authentication**, then create a token for the service account. Copy the JWT (it starts with `eyJ`). Use the REST auth token — not an HEC token (which is a UUID).
  </Step>

  <Step title="Option B — use a service account (Basic)">
    Basic auth works with no server change. Create a Splunk user with a role that can search the relevant indexes, then set **Authentication Method** to `basic` and provide the username and password.
  </Step>

  <Step title="Grant the right role">
    The account (or the token's user) needs to search your indexes. For Enterprise Security notable triage and updates, assign the **ess\_analyst** role. Do not grant `can_delete`.
  </Step>
</Steps>

<Tip>
  Prefer the JWT token method and least privilege. Keep the role scoped to the indexes Myrmex needs, plus `ess_analyst` only if you use notable triage.
</Tip>

## Step 2 — Add the Integration in Myrmex

From the **Directory**, choose **Add Integration → Splunk**, then fill in:

| Field                          | Description                                                                                                                  |
| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------- |
| **Name**                       | A unique name for this Splunk instance.                                                                                      |
| **Description**                | Optional note to identify the search head.                                                                                   |
| **Protocol**                   | Protocol used to reach Splunk (default `https`).                                                                             |
| **Splunk Host**                | Search head host or IP, no scheme (e.g. `splunk-sh.corp` or `stack.splunkcloud.com`).                                        |
| **Management Port**            | Splunk management/REST port (default `8089`).                                                                                |
| **Authentication Method**      | `token` (JWT Bearer, recommended) or `basic` (username/password).                                                            |
| **Authentication Token (JWT)** | Splunk authentication token for Bearer auth (required when method is `token`; must be a REST auth token, not an HEC token).  |
| **Username**                   | Service account username (required when method is `basic`).                                                                  |
| **Password**                   | Service account password (required when method is `basic`).                                                                  |
| **Enterprise Security App**    | App namespace where the ES notable macro resolves (default `SplunkEnterpriseSecuritySuite`). Only used by the notable tools. |
| **Verify TLS Certificate**     | Verify the TLS certificate. Default off (on-prem search heads ship a self-signed cert on `8089`).                            |
| **Collectors**                 | Collectors that can reach this Splunk instance.                                                                              |

## Connect

Click **Connect** to validate the REST connection and finish. Splunk then appears under **Environment → Integrations**, and you can ask about it in the Workspace or through the [Integration Specialist agent](/documentation/multi-agent-system/integration-specialist-agent).

<Note>
  Leave the token blank and set the method to `basic` to use username and password. If you use Enterprise Security in a custom app, update the **Enterprise Security App** field so the notable macro resolves.
</Note>