Connect Splunk (validator)

To validate runs against a Splunk target, install the TA-Tracemill add-on in your Splunk and authenticate it to the target with a validator token. Tracemill Cloud walks you through this in the target's Connect validator drawer; this page is the reference for each step.

1. Issue a target key

In Tracemill Cloud, open the target and choose Connect validator → Issue key. The token (tmv_…) is shown once — copy it immediately. We store only a hash and cannot show it again; if you lose it, issue a new key. A target can hold up to two active keys at a time for make-before-break rotation.

2. Install the add-on

Download the add-on package and install it in Splunk Web:

• Get the latest package: TA-tracemill (.spl). (A Splunkbase listing is coming.)
• In Splunk Web → Apps → Manage Apps → Install app from file, upload the .spl.

Cloud vs. self-managed

The same .spl package works everywhere; how you install it depends on your deployment:

• Self-managed Splunk and Splunk Cloud (Victoria experience): upload the .spl directly via Install app from file (above).
• Splunk Cloud (Classic experience): self-service file upload is restricted. Open a Splunk support ticket to have the add-on installed on your stack.
• Automating installs: Splunk Cloud admins can install the add-on as a private app through the Admin Config Service (ACS); on self-managed Splunk you can deploy it with your usual app-management tooling (deployment server, Splunk CLI, or configuration management).

3. Configure the connection

In the Tracemill Add-on:

1. Under Configuration → Connection, add a connection with:
   • API URL — your Tracemill platform origin (for example https://api.tracemill.io).
   • Validator Token — the tmv_… token from step 1.
2. Under Inputs → Create New Input → Tracemill Task Poller, select that connection and set the Polling Interval (default 60 seconds; 5–600).
3. Save. The add-on begins polling for validation tasks.

4. Confirm it's connected

Once the add-on makes its first call, the target's setup checklist in Tracemill Cloud flips to TA connected and shows when it was last seen.

Data sent to Tracemill

All communication is outbound HTTPS from the add-on to your configured API URL, authenticated with the target-scoped tmv_ token.

The control-plane calls (polling for validation tasks, acknowledging them, reading task state) carry the input's own settings and no Splunk data: the task poll reports its poll interval, its detection-inventory interval, and whether detection-inventory reporting is enabled, so Tracemill can judge how current a catalog should be and tell a quiet add-on from a deliberately disabled one. Beyond those settings, the only data that leaves your Splunk is these three flows:

1. Detection inventory (periodic, can be disabled). For each scheduled, shared saved search in the configured Curated Apps: app, owner, title, enabled/scheduled state, and classification signals (action.correlationsearch.enabled/.metadata/.annotations, presence of ESCU keys) — plus a scan digest, scanned count, partial-visibility flag, the add-on version, and an instance fingerprint from /services/server/info (GUID, server name, Splunk version, cluster label). This powers the detection catalog and target resolution in Tracemill Cloud.
2. Event observations: the Tracemill-generated event ID and the timestamp it was observed in Splunk.
3. Alert correlation: the fired detection's name, fire time, workload index, and a source reference (search job SID / savedsearch id). When the alert is correlated to a specific generated event, the matched Tracemill event ID is included; aggregate/result-row correlations carry no event ID.

Never sent: raw events or search results, SPL search strings, index names, Splunk session keys, or any customer log data. Validation only ever searches for events Tracemill itself generated.

To stop the periodic version of flow 1, disable Detection Inventory Reporting on the input (flows 2–3 are the validation function itself). While disabled, the add-on records a detection_inventory_disabled event in _internal instead of reporting on its own schedule.

An inventory refresh you request explicitly from Tracemill Cloud still runs while reporting is disabled, so an operator on your account can always obtain a current catalog on demand. Disabling therefore stops the add-on's own schedule, not every possible inventory read. To stop all of it, disable or remove the input itself — clearing Curated Apps does not do it, since an empty selection falls back to the default DA-ESS-ContentUpdate scope.

Troubleshooting

• Still "waiting for first poll": confirm the input is enabled, the API URL is reachable from Splunk, and the token hasn't been revoked.
• Auth failures: the token must start with tmv_ and belong to this target; re-issue if unsure.
• TLS verification failures: the add-on always verifies the Tracemill endpoint's certificate. If your egress passes through a TLS-inspection proxy with a private CA, add that CA to the trust store Splunk's Python uses (or exempt the Tracemill API host from inspection) — verification cannot be disabled.