IT Operations · Integration
Splunk
Add Splunk to your product for your customers, and give your AI agents governed access to it.
Splunk is where a lot of operational truth ends up, so integrating it usually means moving in two directions at once: getting events in and getting answers out. An embedded Splunk integration dispatches searches and reads their results, reads saved searches and the alerts they fire, and sends events into a customer's indexes through HTTP Event Collector. Three realities shape how you use it. A search is a job rather than a request, so it is dispatched and then followed to completion, and a wide time range is expensive for the customer as well as slow for you. Deployments differ, since Splunk Cloud and Splunk Enterprise are reached at different endpoints and index names and sourcetypes are chosen locally. And results are bounded by the role behind the token, so what comes back is only what that account may see. fastn holds each deployment's token per tenant and follows the API.
In your product
Embedded for your customers. Per-tenant auth, no per-customer code, maintained by fastn.
Let each customer connect their own Splunk deployment, cloud or on premise, so your product queries the data where it already sits.
Run a search scoped to the indexes and time range a customer nominates, and read the results into your product.
Send your product's own events into their index through HTTP Event Collector so their team can correlate them.
Read saved searches and alerts so your product reacts to detections that customer already trusts.
For your AI agents
Governed, audited access for the agents you build, through the MCP server.
An agent runs a bounded search to investigate an incident and quotes the events it found.
An agent reads which alerts fired in a window and summarises what they have in common.
An agent writes an annotation event into an index within scoped permissions, with the call logged.
Example prompt
Search the last two hours for errors from this service and tell me which host they cluster on.
Set up Splunk in 4 steps
- 01Enable the Splunk connector in your fastn dashboard.
- 02Have each customer supply a token for their own deployment, with a role that can only reach the indexes you agreed.
- 03Decide which searches your product runs and which events it sends, then map the fields you read back.
- 04Call it from your product and expose the same connection to your agents through the MCP gateway.
Why teams use the Splunk integration
What you get by embedding it with fastn instead of building it yourself.
- Ship a Splunk integration without building it. Your customers connect their own Splunk account inside your product and work their incidents, alerts and on-call schedules there, with no per-customer code on your side.
- Handle the part that actually costs time: alerting is latency-critical and noisy, so filtering and deduplication matter. fastn owns the auth, token refresh, rate limits, pagination and breaking-change fixes, so a Splunk update is not your on-call problem.
- One integration serves your product and your agents. The same governed Splunk connection powers in-product features and gives AI agents scoped, audited access, so you route operational signal to the people and systems that act on it without wiring it twice.
Used by these teams
Compare with
Datadog
ServiceNow
PagerDutyOften used alongside
Tools the same teams tend to run next to Splunk, across other categories.
AWS Secrets Manager
AppViewX
Azure Key VaultSplunk integration FAQ
How do I add a Splunk integration to my product?
Enable the Splunk connector in your fastn dashboard, then let each customer authenticate their own Splunk account. fastn handles the OAuth flow, token storage and refresh per tenant, so there is no Splunk client code in your app and no per-customer branch in your codebase. Setup is 4 steps.
Do my customers each connect their own Splunk account?
Yes. Every connection is scoped to the individual customer, so each authorises their own Splunk account and only ever sees their own incidents, alerts and on-call schedules. That per-tenant isolation is the point of an embedded integration: you support the long tail of customer setups without maintaining an integration per customer.
Can AI agents use this Splunk integration?
Yes. The same connection is exposed to your agents through the fastn MCP gateway, with permissions scoped per tenant and every call audited. An agent runs a bounded search to investigate an incident and quotes the events it found.
Who maintains the Splunk integration?
fastn does. When Splunk changes an endpoint, deprecates a field or alters its auth, the fix lands in the connector rather than in your backlog, and your customers' connections keep working.
How fast does a Splunk alert reach my product?
Alerts arrive through event triggers rather than polling, so your product reacts in near real time instead of on a schedule.
Can duplicate or flapping alerts be suppressed?
Yes. Events are deduplicated per incident, so a flapping check does not create a queue of identical records for your users to sift through.
What can I build with the Splunk integration?
A common starting point: let each customer connect their own Splunk deployment, cloud or on premise, so your product queries the data where it already sits. Teams also use it for the other use cases listed above, and expose it to agents for governed reads and writes.
How much does the Splunk integration cost?
It is included. Pricing is based on connected accounts, not on how many connectors you enable, so adding Splunk does not change your per-connector cost. You can start free with 3 connected accounts.
Add Splunk to your product
Start free with 3 connected accounts. No sales call required, and no per-customer integration code.