Splunk

Connect Splunk to collect observability evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Splunk:

   1. Sign in to Splunk Web as a user whose role has the edit_tokens_own capability (or edit_tokens_all to create a token for another user). Token authentication must be enabled first.
   2. In the system bar, click Settings › Tokens.
   3. Click New Token. The New Token dialog box appears.
   4. In the User field, enter the Splunk platform user the token is for (a user holding the sc_admin role, which Safeguard needs to read users).
   5. In the Audience field, enter a short description, for example Safeguard.
   6. Optionally set Expiration and Not before.
   7. Click Create, then copy the text in the Token field and click Close.
   8. To open search head API access (port 8089) to Safeguard, go to Settings › Server settings › IP allow list, select the Search head API access tab and use Add IP subnet to add Safeguard's outbound address. This needs a role with edit_ip_allow_list (the sc_admin role has it by default).

   Where to find the other values:

   • Instance ID: The deployment name in your Splunk Cloud Platform URL: https://<deployment-name>.splunkcloud.com (for example acme in acme.splunkcloud.com). The REST API is reached at https://<deployment-name>.splunkcloud.com:8089.

   Splunk shows the secret only once, so copy it before you leave the page.

   Splunk shows the token only once. The search-api (port 8089) allow list is closed by default on Splunk Cloud Platform; it can also be opened with the ACS API or a Splunk Support case. The list_users capability name was not confirmed on a fetched page; sc_admin is documented as holding edit_ip_allow_list. The Environment (optional) field has no vendor-side location documented.

   Source: help.splunk.com, help.splunk.com, help.splunk.com, checked 2026-10-07.

   The permissions Safeguard needs: sc_admin, list_users, search-head API access (port 8089). If Splunk restricts API access by IP address, allow Safeguard's outbound address.

2. On Compliance › Connectors, open Splunk, click Connect, choose API token and fill in:

   Field	What to enter
   API token	Required. Stored encrypted and never shown again.
   Instance ID	Required. For example: acme
   Environment (optional)	—

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Splunk and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Observability connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks