> For the complete documentation index, see [llms.txt](https://docs.pagerly.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.pagerly.io/sre-ai-agent/data-sources/splunk.md).

# Splunk

## What the Agent Can Do

* Run search queries using SPL (Search Processing Language)
* Search logs by index, sourcetype, and time range
* Get search results from completed jobs

## Setup Instructions

1. Log into your **Splunk instance**
2. Go to **Settings** > **Tokens** (under Data Inputs)
3. Click **New Token**, give it a name (e.g., `Pagerly`)
4. Set allowed indexes as needed
5. Copy the token and your Splunk URL

## Required Credentials

| Field          | Description                                  | Example                             |
| -------------- | -------------------------------------------- | ----------------------------------- |
| **Splunk URL** | Your Splunk REST API URL (usually port 8089) | `https://mysplunk.example.com:8089` |
| **Auth Token** | Splunk authentication token                  | `your-splunk-token`                 |

## Context Prompt Tips

> *"Our logs are in the main index. Use sourcetype=access\_combined for web logs. Error events have level=ERROR."*

## Docs

* [Splunk REST API Reference](https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTprolog)