Splunk Permissions
The Splunk tool (see Tools & Integrations) authenticates with an authentication token (recommended) or a username and password. Every Splunk tool is read-only: CloudPeek runs searches and lists metadata; it never writes to indexes, changes configuration or creates saved searches.
Create a dedicated service account with a role granting only the following, and issue the token for that account:
| Capability / access | Description | Use case |
|---|---|---|
search capability | Run search jobs against the indexes the role allows | Run SPL searches for investigation evidence, including one-shot and exported searches (splunk_search, splunk_oneshot_search, splunk_export_search) |
Allowed indexes (srchIndexesAllowed) | The indexes the role may search | Bound exactly which data the AI can query; only list the indexes you want investigable (splunk_get_indexes shows what the role can see) |
| Read access to saved searches | View and dispatch existing saved searches | List your saved searches and run one as part of an investigation, without being able to modify it (splunk_get_saved_searches, splunk_run_saved_search) |
| Read access to apps and sourcetypes | List installed apps and sourcetypes | Discover what data is available so searches target the right sourcetypes (splunk_get_apps, splunk_get_sourcetypes) |
Note
Restricting the role's allowed indexes is the primary control: searches, saved searches and index listings all respect it, so CloudPeek can never read data from an index the role cannot search. Avoid granting admin capabilities such as admin_all_objects; none of the tools need them.