Connect Splunk (validator)

To validate runs against a Splunk target, install the TA-Tracemill add-on in your Splunk and authenticate it to the target with a validator token. The console walks you through this in the target's Connect validator drawer; this page is the reference for each step.

1. Issue a target key

In the console, open the target and choose Connect validator → Issue key. The token (tmv_…) is shown once — copy it immediately. We store only a hash and cannot show it again; if you lose it, issue a new key. A target can hold up to two active keys at a time for make-before-break rotation.

2. Install the add-on

Download the add-on package and install it in Splunk Web:

• Get the latest package: TA-tracemill (.spl). (A Splunkbase listing is coming.)
• In Splunk Web → Apps → Manage Apps → Install app from file, upload the .spl.

Cloud vs. self-managed

The same .spl package works everywhere; how you install it depends on your deployment:

• Self-managed Splunk and Splunk Cloud (Victoria experience): upload the .spl directly via Install app from file (above).
• Splunk Cloud (Classic experience): self-service file upload is restricted. Open a Splunk support ticket to have the add-on installed on your stack.
• Automating installs: Splunk Cloud admins can install the add-on as a private app through the Admin Config Service (ACS); on self-managed Splunk you can deploy it with your usual app-management tooling (deployment server, Splunk CLI, or configuration management).

3. Configure the connection

In the Tracemill Add-on:

1. Under Configuration → Connection, add a connection with:
   • API URL — your Tracemill platform origin (for example https://api.tracemill.io).
   • Validator Token — the tmv_… token from step 1.
2. Under Inputs → Create New Input → Tracemill Task Poller, select that connection and set the Polling Interval (default 60 seconds; 5–600).
3. Save. The add-on begins polling for validation tasks.

4. Confirm it's connected

Once the add-on makes its first call, the target's setup checklist in the console flips to TA connected and shows when it was last seen.

Troubleshooting

• Still "waiting for first poll": confirm the input is enabled, the API URL is reachable from Splunk, and the token hasn't been revoked.
• Auth failures: the token must start with tmv_ and belong to this target; re-issue if unsure.