Set up the Axiom Portal for Splunk in standard mode

Learn how to register the Axiom Portal for Splunk as a federated provider in standard mode and map Axiom datasets as federated indexes.

In standard mode, each Axiom dataset you expose is mapped to a Splunk federated index, and users search it as index=federated:<name>. Standard mode is explicit, simple to reason about, and the recommended starting point. For how the modes differ, see How the Portal works.

Prerequisites

Create an advanced API token in Axiom with query permissions on the datasets you want to expose. The token needs no other permissions.
Determine your Axiom organization ID.
A Splunk Enterprise 9.0 or later search head, or Splunk Cloud Platform on the Victoria Experience, and a Splunk role with permissions to manage federated search. The search head must be able to reach splunk.portal.axiom.co on port 443 over HTTPS. If your Splunk Cloud environment restricts outbound traffic, allow egress to this host and port first.

Register the Portal as a federated provider

In Splunk Web, go to Settings, and then select Federated search.

Click Add federated provider and fill in the fields:

For the provider mode, select Standard.
Enter a provider name, for example axiom.
For the remote host, enter splunk.portal.axiom.co:443.
For the service account username, enter your Axiom organization ID.
For the service account password, enter your Axiom API token.

Click Test connection, and then save the provider.

Map datasets as federated indexes

Create one federated index for each Axiom dataset you want to expose:

In Splunk Web, go to Settings, select Federated search, and then click Add federated index.

Fill in the fields:

Enter a federated index name, for example http-logs. This becomes the name users search: index=federated:http-logs.
Select the federated provider you created.
For the remote dataset, enter the Axiom dataset name. Datasets the token can query are listed for autocomplete.

Repeat for each dataset. When you add datasets in Axiom later, map them the same way.

Verify the setup

Run a search that queries Axiom:

SPL

index=federated:http-logs | stats count

An exact event count confirms that authentication, dataset mapping, and query pushdown all work. Then try a raw event search:

SPL

index=federated:http-logs | head 20

If either search shows an error banner, see Monitor and troubleshoot.

What’s next

SPL command support
Examples
Want your Splunk lookups and data models to work against Axiom data? Set up transparent mode.