Set up the Splunk Portal in transparent mode

Learn how to register the Axiom Splunk Portal as a federated provider in transparent mode so datasets are searchable by name and your knowledge objects work against Axiom data.

In transparent mode, Axiom datasets are directly addressable by their own names, as index=<name>, with no per-dataset mapping. Splunk also replicates the search head’s knowledge bundle to Axiom, so your existing knowledge objects work against Axiom data:

CSV lookups, both explicit | lookup and automatic lookups defined in props.
Data models, including tstats queries and pivot.
Tags and event types, which the search head expands before dispatch.

Transparent mode requires a Splunk Enterprise search head. Splunk doesn’t support transparent mode from Splunk Cloud Platform to a remote provider, so on Splunk Cloud use standard mode instead. For how the modes differ, see How the Splunk Portal works.

If you use Splunk Enterprise Security, transparent mode is the mode to use: Splunk doesn’t support standard mode federated search with Enterprise Security.

Prerequisites

Create an advanced API token in Axiom with query permissions on the datasets you want to expose. The token needs no other permissions.
Determine your Axiom organization ID.
A Splunk Enterprise 9.0 or later search head, and a Splunk role with permissions to manage federated search. The search head must be able to reach splunk.portal.axiom.co on port 443 over HTTPS.

Register the Portal as a transparent mode provider

In Splunk Web, go to Settings, and then select Federated search.

Click Add federated provider and fill in the fields:

For the provider mode, select Transparent.
Enter a provider name, for example axiom.
For the remote host, enter splunk.portal.axiom.co:443.
For the service account username, enter your Axiom organization ID.
For the service account password, enter your Axiom API token.
Turn on the use of the search head’s knowledge objects for this provider.

Click Test connection, and then save the provider.

There are no federated indexes to create. Every dataset the token can query is immediately searchable by its Axiom dataset name.

Knowledge bundle replication

After you save the provider, Splunk automatically replicates the search head’s knowledge bundle to the Portal and keeps it up to date with delta updates. The Portal uses the replicated bundle to evaluate lookups and data model definitions during searches, the same way a remote Splunk indexer would. Bundles are stored per organization and are never shared.

Scripted, external, and KV store lookups are the exception: they execute code inside a Splunk instance, so no federated provider can run them. CSV lookups, by far the most common case, work fully. For details, see SPL command support.

Verify the setup

Search a dataset directly by name:

index=http-logs | stats count

An exact event count confirms authentication and pushdown. If you use lookups, verify one end to end:

index=http-logs | lookup status_names status OUTPUT status_label | stats count by status_label

The lookup table lives on your Splunk search head and is joined against Axiom data through the replicated bundle. If you use data models, verify tstats:

| tstats count from datamodel=Web by Web.status

If a search shows an error banner, see Monitor and troubleshoot.