Splunk Execution Credentials

Configure Splunk management credentials that DAP workers use when executing approved change plans

Splunk Execution Credentials

Before a change plan can roll out, DAP must know how to reach each target host's Splunk management API. You configure those credentials on the Splunk Credentials page under DAP Platform.

Navigation

Why Credentials Matter

When you click Execute on an approved plan, DAP worker nodes connect to each target host's Splunk management port to apply configuration changes. The platform stores Splunk management credentials separately from your Deslicer login — workers read them at execution time.

If credentials are missing or do not cover every host the plan targets, the Execute dialog shows a warning and blocks rollout until you fix coverage.

Opening the Page

Navigate to Automation Platform → Platform → Splunk Credentials.

You need the DAP Platform manage or Tenant manage capability to add, edit, test, or delete credentials. Other users can view the configured list (labels, scope, auth mode, and last test time) but cannot change secrets.

Credential Scopes

Each credential applies at one of three scopes. At execution time, the most specific match wins:

ScopeWhen It Applies
Tenant defaultFallback for any host when no group or host credential exists
Host groupOverrides the tenant default for every host in the selected group
Specific hostOverrides both group and tenant defaults for one enrolled host

The form reminds you: host overrides group overrides tenant.

Coverage Rules for Plan Execution

When you open the Execute dialog on a plan, Deslicer checks that credentials cover the plan's targets:

Plan targetingWhat satisfies readiness
Target group onlyA tenant default credential, or a host-group credential for that group
Specific hosts (per-host change items)Each targeted host has a host-scoped credential, or a matching host-group credential for the plan's target group, or a tenant default

If any targeted host is uncovered, you see a message such as Missing Splunk credentials for plan targets with a link back to this page.

Adding a Credential

  1. Scroll to Add credential on the Splunk Credentials page.
  2. Enter a Label you will recognize later (for example, prod-indexers-mgmt).
  3. Choose Auth mode:
    • Basic — username and password for Splunk management API access
    • Token — Splunk authentication token
  4. Enter the Management URL — the HTTPS endpoint for the host's Splunk management API (typically port 8089).
  5. Select Scope — tenant default, host group, or specific host. Group and host scopes require picking the target from enrolled hosts and groups.
  6. Optionally paste a CA certificate PEM if the management endpoint uses a private CA.
  7. Click Save.

Secrets are stored encrypted. After saving, only a masked tail of the secret is shown in the list — the full value is never returned.

Testing and Managing Credentials

The credentials table shows scope, auth mode, management URL, and when the connection was last tested.

ActionWhat It Does
TestVerifies the management URL, credentials, and TLS settings. On success, the Splunk version is recorded.
EditUpdate label, URL, auth mode, username, secret, or CA cert. Scope and host targeting are fixed after creation — delete and recreate to change scope.
DeleteRemoves the credential. Plans that depended on it may block execution until you add a replacement.

Tips

  • Start with a tenant default credential if every host in the fleet shares the same management account. Add host or group credentials only where accounts differ.
  • Run Test after any URL or secret change before executing a plan.
  • If execution is blocked, open the plan's Execute dialog — the warning names whether you need a tenant default, a group credential, or per-host coverage.
  • Compliance and remediation plans that attach change items to individual hosts are evaluated per host ID, not only by target group.