Enable Splunk Enterprise provisioning

Enale provisioning for your Splunk Enterprise instance to integrate with Okta.

Prerequisites

You need the following to configure provisioning for your Splunk app integration:

A Splunk authentication token. Token generation may be restricted to users with admin capabilities.

To generate an authentication token in your Splunk Enterprise instance, go to SettingsTokensNew Token.

The authentication token requires the following capabilities:
- edit_user
- list_all_roles
- edit_httpauths
- list_httpauths
To understand what capabilities are granted with each of these scopes, see Define roles on the Splunk platform with capabilities.
The host name of your Splunk Enterprise instance.

For example, if your Splunk Enterprise instance is: https://example.splunkcloud.com, enter example.splunkcloud.com for the host name.
The port of your Splunk Enterprise instance. The default port is 8089, however this value may be different for your instance.

If necessary, you may need to contact Splunk support to open port 8089 on your instance. See Splunk Cloud Platform URL for REST API access.
Also, if your Splunk Enterprise instance has a configured list of allowed IP addresses, add the required Okta IP addresses to that list. See Allow access to Okta IP addresses.

To configure provisioning for you Splunk Enterprise app, complete the following steps:

In the Admin Console, go to ApplicationsApplications.
Select your Splunk Enterprise app integration.
On the Provisioning tab, click Configure API Integration.
Select Enable API Integration.
Enter your Splunk Enterprise Auth Token, Port, and Hostname.

Splunk doesn't support import groups functionality, so the Imports Group option is ignored.
Optional. Click Test API Credentials to validate your integration settings.
Click Save.
After the integration is authorized, select To App in the Settings panel.
Select the provisioning features that you want to enable: