Splunk is a data analytics and observability platform that enables organizations to search, monitor, and analyze machine data for security, IT operations, and business insights.
Required Permissions
Create a dedicated Scytale service role with the minimum required permissions by following the steps below, or use an existing user with sc_admin privileges.
Scytale follows the least-privilege principle, limiting permission scopes strictly to what's required for audit evidence collection.
How to Connect
In Scytale, go to 'Integrations'.
Search for Splunk and select 'Connect'.
Paste your Bearer token & Token for the Service Account key.
Add Scytale's IP to the Search Head API Allow List.
Add a connection name — this will be used to differentiate between your connections — and then select 'Connect'.
You have now successfully connected to Splunk.
How to Generate a Bearer Token in Splunk
In your Splunk Cloud dashboard, go to Settings → Tokens
If Token Authentication is not enabled, click Enable Token Authentication
Click New Token, enter a username and an audience value, then click Create
Copy the token immediately — it is only shown once
How to get the instance URL
The instance URL is derived from your Splunk Cloud dashboard URL. It typically follows the format.
The <host-name>.splunkcloud.com portion is what you need.
How to check the port:
Splunk's REST API runs on the splunkd management port, which is 8089 by default.
Add Scytale's IP to the Search Head API Allow List
To allow Scytale to interact with your Splunk Cloud environment, you must add Scytale's outbound IP CIDR to the Search Head API Allow List. Port 8089 is not exposed to any subnet by default on Splunk Cloud.
To configure the allow list:
Navigate to Settings → Server Settings
Select IP Allow List
Click the Search Head API access tab
Click + Add IP subnet, enter Scytale's outbound IP CIDR, and click Save
If the IP Allow List option is not visible in the UI, submit a support case to Splunk Support requesting that port 8089 be opened, specifying Scytale's outbound IP CIDR.
API usage
Base URL:
https://<instance-host>:8089All requests must be made over HTTPS on the splunkd management port (8089)
Auth header on every request:
Authorization: Bearer <token>Scytale's outbound IP address added to the Search Head API Allow List
How to Create a Service Account Role and User in Splunk
Follow these steps to create a dedicated Scytale service account with the minimum required permissions.
Step 1 — Create the Role
Go to Settings → Roles
Click New Role
Set Role name to
scytale_serviceaccountGo to the Inheritance tab and add:
ess_analystmc_analystess_userGo to the Capabilities tab and enable:
rest_access_server_endpointslist_settingsadmin_all_objectschange_authenticationedit_userlist_all_objectslist_all_roleslist_all_usersClick Save
Step 2 — Create the User
Go to Settings → Users
Click New User
Fill in:
Username:scytale_serviceFull Name:
Scytale IntegrationPassword: a strong password
Under Assign Roles, add
scytale_integration⚠️ Make sure to select
userrole (on the right side) — it needs to be selected in order to switch the role with your custom oneClick Save
Step 3 — Create a Token for the Service Account
Go to Settings → Tokens
Click New Token
Set User to
scytale_serviceSet Audience to
scytaleSet Expiration as needed
Click Create and copy the token immediately — shown only once