Cisco Splunk Endpoint Target

Last updated
Save as PDF

Cisco Splunk Endpoint targets enable integration with Cisco Splunk management REST APIs and optional HTTP Event Collector endpoints. By configuring a Cisco Splunk Endpoint target, you can use workflows to send API requests to Splunk, run search automation, inspect access context, manage supported objects, and send events through HEC.

Cisco Splunk Endpoint targets require Cisco Splunk Credentials account keys and are used with Cisco Splunk workflow activities, including the Cisco Splunk API Request activity.

Before You Begin

Before adding Cisco Splunk as a target type in Workflows, ensure that you have:

Access to a Cisco Splunk deployment with permission to use the required management REST APIs.
The management API host name for the Splunk deployment, such as acme.splunkcloud.com.
Access to the management REST API port. The Cisco Splunk schema defaults to port 8089.
Cisco Splunk Credentials saved in Workflows.
If you plan to use HTTP Event Collector, the HEC host name and an active HEC token.

Creating Cisco Splunk Targets

Perform the following steps to create a new Cisco Splunk target:

From the left navigation menu, click Automation > Targets.
Click New Target.
From the Target Type drop-down list, choose Cisco Splunk Endpoint.
Enter a unique display name for the target in the Display Name field and a brief description in the Description field.
In the Account Keys area, click the Default Account Keys drop-down list and choose an existing Cisco Splunk Credentials account key, or select Add New to create a new account key.
In the Connection area, enter the protocol, host, port, and certificate validation settings.
In the HEC (Optional) area, enter the HEC host, HEC port, and HEC certificate validation settings only if workflows will send events through HTTP Event Collector.
In the Proxy area, enter the URL, username, and password for your proxy server if required.
Use the Proxy Bypass List to provide hosts to exclude from the proxy. Use the Ignore Proxy toggle to display or hide proxy settings.
Click Save to save the target.

Connection Fields

Protocol: Choose HTTPS.
Host: Enter the host name for the Cisco Splunk management API endpoint. Do not include the protocol or port.
Port: Enter the management REST API port. The default is 8089.
Disable Certificate Validation: Enable this option only for test environments where certificate validation must be bypassed.

HEC Fields

HEC Host: Enter the HEC host name, such as http-inputs-<stack>.splunkcloud.com or http-inputs.<stack>.splunkcloud.com.
HEC Port: Enter the HEC port. The default is 443.
Disable HEC Certificate Validation: Enable this option only for test environments where HEC certificate validation must be bypassed.

After the target is saved, select it in a Cisco Splunk workflow activity, such as Cisco Splunk API Request, and provide the relative API path and request details required for the Splunk API operation.