Splunk

The Splunk connector is a Palantir-provided driver for Splunk.

To create a new Splunk source, follow the standard setup flow for Palantir-provided drivers, then use the sections below for Splunk-specific configuration and networking. For the complete property reference, see the official Splunk driver documentation ↗.

Configuration

The properties below are mandatory or recommended.

Property	Required?	Description	Default
AuthScheme ↗	Mandatory	Whether to use Basic Authentication, AccessToken or HTTPEventCollectorToken Authentication when connecting to Splunk.	Basic
URL ↗	Mandatory	The URL to your Splunk endpoint.	https://mySite.splunk.com:{port}
Password ↗	Recommended	Specifies the password of the authenticating user account.	—
User ↗	Recommended	Specifies the user ID of the authenticating Splunk user account.	—

Networking

The table below lists the domains that the source needs to be able to access in order to successfully run.

For each domain, add a corresponding egress policy. If the source is hosted on-premises and not directly reachable from Foundry, use an agent proxy egress policy instead; the agent host itself must also be able to reach the listed domains. See using an agent as a proxy for details.

Domain	Required
\	Always. URL connection property, URL with management port, i.e. https://yoursitename.splunk.com:8089

---

中文翻译

Splunk

Splunk 连接器是 Palantir 为 Splunk 提供的驱动程序。

要创建新的 Splunk 数据源，请遵循 Palantir 提供驱动程序的标准设置流程，然后使用以下各节进行 Splunk 特定的配置和网络设置。有关完整的属性参考，请参阅官方 Splunk 驱动程序文档 ↗。

配置

以下属性为必填或推荐项。

属性	是否必填	描述	默认值
AuthScheme ↗	必填	连接到 Splunk 时使用基本认证(Basic Authentication)、访问令牌(AccessToken)还是 HTTP 事件收集器令牌认证(HTTPEventCollectorToken Authentication)。	Basic
URL ↗	必填	Splunk 端点的 URL。	https://mySite.splunk.com:{port}
Password ↗	推荐	指定认证用户账户的密码。	—
User ↗	推荐	指定认证 Splunk 用户账户的用户 ID。	—

网络配置

下表列出了数据源为成功运行而需要能够访问的域名。

对于每个域名，请添加相应的出站策略。如果数据源部署在本地且无法直接从 Foundry 访问，请改用代理出站策略；代理主机本身也必须能够访问所列出的域名。详情请参阅使用代理作为代理服务器。

域名	是否必需
\	始终必需。URL 连接属性，包含管理端口的 URL，例如 https://yoursitename.splunk.com:8089