Splunk Observability

This guide explains how to connect ResolveAI with Splunk Observability Cloud. Resolve uses this connection to ingest metrics, logs, dashboards and traces for incident investigations.

1. Create Org Access Token

In Splunk Observability Cloud, create an Org Access Token with API Permissions.

Log in to Splunk Observability Cloud
Click Settings in the left navigation
Select Access Tokens under the Organization Settings section
Click Create Token
Under the Name and Scope tab:
- Set the name to resolve-token or another appropriate name
- Select API Token with Roles with read_only as the token scope
- Click Next
Under the Permissions tab:
- Set the appropriate access token permission, Only Admins can read is the default
- Click Next
Under the Expiration tab:
- Set the appropriate end date (1 year is recommended)
- Click Create
Click Copy to copy the token value and save it securely

New Relic integration setup in Resolve

2. Connect Splunk Observability

Set up the integration either in the Resolve UI or in the Satellite configuration.

Resolve UI
Satellite

Connect Via Resolve UI

Open Splunk Observability Integration in Resolve
Click Add Connection
Enter a name (ex. Splunk-Observability-Main)
Leave Environments blank to ingest data from all environments, or list specific ones that match your Satellite config
Paste your Org Access Token from Step 1
Enter your Realm (ex. us0, us1, eu0, etc.)
- Your realm is visible in your Splunk Observability URL: app.<realm>.signalfx.com
(Optional) Enable Sensitive Data Redaction
Turn on the toggle Service Map Enabled
Click Save

Connect Via Satellite

Save the Splunk Observability Org Access Token in a Kubernetes secret, then update the Resolve Satellite to use this secret.

1. Create Kubernetes Secret

Create a Kubernetes secret using this structure.

secret creation

apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: splunk-observability-resolve-token
stringData:
  token: "<your org access token>"

Security Best Practice: Never store credentials in plaintext in configuration files or source control. Always use Kubernetes secrets and encrypt etcd or use enterprise secret management systems. See Secret Management for detailed guidance.

Apply the secret.

apply secret

kubectl apply -f splunk-observability-resolve-token.yml

2. Update Values File

Add the Splunk Observability integration to resolve-values.yaml.

resolve-values.yaml

integrations:
  splunkObservability:
    type: "splunkObservability"
    create: true
    secretName: "splunk-observability-resolve-token"
    connection:
      realm: "us0"  # Replace with your realm (us0, us1, eu0, etc.)

(Optional) Add sensitive data redaction with redactionConfig.

resolve-values.yaml

integrations:
  splunkObservability:
    type: "splunkObservability"
    create: true
    secretName: "splunk-observability-resolve-token"
    connection:
      realm: "us0"  # Replace with your realm
      redactionConfig:
        enabled: true

3. Apply Changes

Update the satellite with the new resolve-values.yaml file.

helm upgrade --install resolve-satellite \
  oci://registry-1.docker.io/resolveaihq/satellite-chart \
  --values resolve-values.yaml

4. Verify Integration

Open Splunk Observability Integration and check the connection.

​1. Create Org Access Token

​2. Connect Splunk Observability

​Connect Via Resolve UI

​Connect Via Satellite

​1. Create Kubernetes Secret

​2. Update Values File

​3. Apply Changes

​4. Verify Integration

1. Create Org Access Token

2. Connect Splunk Observability

Connect Via Resolve UI

Connect Via Satellite

1. Create Kubernetes Secret

2. Update Values File

3. Apply Changes

4. Verify Integration