Set up the Axiom Portal for Splunk in standard mode
If you use Splunk Enterprise Security, set up transparent mode instead. Splunk doesn’t support federated search in standard mode with Enterprise Security.
Prerequisites#
- Create an advanced API token in Axiom with query permissions on the datasets you want to expose. The token needs no other permissions.
- Determine your Axiom organization ID.
- A Splunk Enterprise 9.0 or later search head, or Splunk Cloud Platform on the Victoria Experience, and a Splunk role with permissions to manage federated search. The search head must be able to reach
splunk.portal.axiom.coon port 443 over HTTPS. If your Splunk Cloud environment restricts outbound traffic, allow egress to this host and port first.
The dataset scope of the token defines what Splunk can see. Splunk users can only search datasets the token can query, and revoking the token removes access immediately.
Register the Portal as a federated provider#
In Splunk Web, go to Settings, and then select Federated search.
Click Add federated provider and fill in the fields:
- For the provider mode, select Standard.
- Enter a provider name, for example
axiom. - For the remote host, enter
splunk.portal.axiom.co:443. - For the service account username, enter your Axiom organization ID.
- For the service account password, enter your Axiom API token.
Click Test connection, and then save the provider.
The service account password is the token value itself, the string starting with xaat-, not the token’s name in the Axiom UI. A mistyped or expired token can still pass Test connection, because the connection test verifies the protocol handshake without running a query. The verification search below is the real credential check.
Map datasets as federated indexes#
Create one federated index for each Axiom dataset you want to expose:
In Splunk Web, go to Settings, select Federated search, and then click Add federated index.
Fill in the fields:
- Enter a federated index name, for example
http-logs. This becomes the name users search:index=federated:http-logs. - Select the federated provider you created.
- For the remote dataset, enter the Axiom dataset name. Datasets the token can query are listed for autocomplete.
Repeat for each dataset. When you add datasets in Axiom later, map them the same way.
Verify the setup#
Run a search that queries Axiom:
index=federated:http-logs | stats countAn exact event count confirms that authentication, dataset mapping, and query pushdown all work. Then try a raw event search:
index=federated:http-logs | head 20If either search shows an error banner, see Monitor and troubleshoot.
What’s next#
- SPL command support
- Examples
- Want your Splunk lookups and data models to work against Axiom data? Set up transparent mode.