Axiom and Splunk

• The Axiom for Splunk app adds a set of ax commands to SPL. You query Axiom datasets explicitly from any Splunk search, enrich existing Splunk events with Axiom context, and run raw APL when you need the full Axiom query language. Any Splunk user can install and configure it with an Axiom API token.
• The Axiom Portal for Splunk registers with your Splunk deployment as a federated search provider and makes Axiom datasets appear as ordinary Splunk indexes, addressed as index=federated:<dataset> or, in transparent mode, directly by name as index=<dataset>. Your team searches them in plain SPL, and existing dashboards, saved searches, and alerts work unchanged. A Splunk admin sets it up once for the whole deployment.

flowchart LR
    User["Splunk user"] --> SH["Splunk search head"]:::splunk
    SH --> App["Axiom app<br/>axsearch, axstats, axquery, …"]:::axiom
    SH --> Fed["Axiom Portal<br/>Axiom datasets as Splunk indexes"]:::axiom
    App --> Axiom[("Axiom")]
    Fed --> Axiom

Choose between the app and the Portal#

The two integrations solve different problems and work well together in the same deployment.

Choose the app when:

• You want to get started without changing Splunk deployment settings. Installing the app doesn’t require federation configuration.
• You want to enrich events that are already in Splunk with context from Axiom. The axlookup command joins Axiom fields onto Splunk search results in one streaming command, with batching and field normalization handled for you.
• You want the full power of APL from inside Splunk. The axquery command runs any APL query and returns the results as Splunk events.

Choose the Portal when:

• Your team already has Splunk dashboards, saved searches, and alerts, and you want them to run against Axiom data without edits.
• End users shouldn’t have to learn anything new. Axiom datasets appear as indexes, and everyone keeps writing the SPL they know.
• You use Splunk knowledge objects like lookups and data models and want them to work against Axiom data. Transparent mode supports this.

A useful way to remember the difference: the app brings Axiom’s query language into your Splunk searches, and the Portal brings Axiom datasets into Splunk itself.

What happens to your data#

Neither integration copies data into Splunk. Axiom stores and queries your event data, and Splunk receives results.

Both integrations push the expensive work down into Axiom. An aggregation like a count by service over billions of events runs inside Axiom and returns a handful of rows to Splunk. Results are exact, not sampled, at any dataset size. For more information on how work is divided between Axiom and the Splunk search head, see How the Portal works.

Access is controlled with Axiom API tokens. Each integration authenticates with a token that has query permissions on the datasets you choose to expose. Revoke the token, and access is gone. For more information, see Tokens.

What’s next#

• Install and configure the Axiom for Splunk app
• Set up the Axiom Portal for Splunk
• Translate SPL to APL