Configure Connection
Splunk guide
Configure Splunk API access in NIM and collect the account lockout report to validate the connection.
Before you beginDirect link to Before you begin
Refer to the vendor's Splunk Enterprise REST API reference for API access and configuration details.
NIM requires Hostname and Client Secret.
Prepare report accessDirect link to Prepare report access
- Identify the Splunk hostname used by the connector.
- Configure API access and obtain the client secret for the NIM connection.
- Confirm that the configured access permits retrieval of the account lockout report data.
- Ensure the NIM server can reach the Splunk API.
Enter the connection settingsDirect link to Enter the connection settings
- In NIM Studio, open Systems > Overview and add a Splunk system, or select the existing system.
- Open Connection, enter the following settings, and save.
| NIM setting | Value |
|---|---|
| Hostname | The Splunk hostname, using the format expected by the Connection screen. |
| Client Secret | The secret configured for the connector's Splunk API access. |
Validate with a collectionDirect link to Validate with a collection
Test Connection always returns success for this connector. Run a system collection to validate connectivity, authentication, and report access.
- Save the connection settings and run a collection for the Splunk system.
- Check collection status and review the retrieved AccountLockoutReport data in NIM.
- If collection fails, verify the Hostname, Client Secret, API permissions, report availability, and network access.
- Confirm the collected data matches the intended audit scope before using it in filters or reports.
The connector's AccountLockoutReport operation is read-only.
Step 1 of 3