Documentation Plugins Splunk data source

Splunk data source

Splunk is a data and log analysis tool used for monitoring and troubleshooting a wide variety of systems. The Splunk data source allows you to query and visualize Splunk data with Search Processing Language (SPL) or a visual SPL editor.

Supported features

Requirements

The Splunk data source has the following requirements:

• A Splunk account.
• A Grafana Cloud Pro or Advanced plan or an activated self-managed Grafana Enterprise license.
• Grafana version 11.6.7 or later.
• Port 8089 enabled on your Splunk instance.

Get started

The following documents help you set up and use the Splunk data source:

• Install the Splunk data source
• Get started with Splunk on Grafana Cloud
• Configure the Splunk data source
• Splunk query editor
• Splunk template variables
• Annotations
• Alerting
• Troubleshoot Splunk data source issues

Additional features

After configuring the data source, you can:

• Use Explore to query Splunk data without building a dashboard.
• Add Annotations to overlay Splunk alerts or events on graphs.
• Configure and use template variables for dynamic dashboards.
• Add Transformations to manipulate query results.
• Set up Alerting rules based on Splunk queries.

Pre-built dashboards

The Splunk data source includes three pre-built dashboards for monitoring Kubernetes environments. These dashboards require Kubernetes data ingested into Splunk via the Splunk OpenTelemetry Collector for Kubernetes.

• Kubernetes overview: Summary statistics on cluster capacity, resource utilization, and pod state. Filter by cluster name and namespace.
• Node overview: Summary statistics for nodes in the cluster. Filter by node and cluster name.
• Pod overview: Summary statistics for Pods in the cluster. Filter by Pod and cluster name.

To import a dashboard, navigate to Connections > Data sources > Splunk, click the Dashboards tab, and click Import.

Plugin updates

Always ensure that your plugin version is up-to-date so you have access to all current features, bug fixes, and security patches. Running outdated versions can cause query failures or compatibility issues with newer Grafana releases.

• Grafana Cloud: Plugins are automatically updated. No action required.
• Self-managed: Navigate to Administration > Plugins and data > Plugins to check for updates, or run grafana cli plugins update grafana-splunk-datasource. Self-managed instances do not receive automatic updates.

For detailed upgrade instructions, plugin_admin_enabled requirements, and version management, refer to Install and upgrade the Splunk data source.

Related resources

• Splunk documentation
• Splunk Infrastructure Monitoring data source for Grafana
• Grafana community forum