Real-time
Two-way sync
Changes in Splunk instantly reflect across connected systems. No stale data, no manual imports.
Analytics
Connect Splunk to any app with two-way sync.
Two-way sync Splunk across all your CRMs, databases, data warehouses, EDI systems, and AI tools, with custom workflows tailored to your data.
- SOC 2 and 6 other compliance frameworks
- POC with real engineers in minutes
Live sync
stacksync.com - <1s
- latency
- 2-way
- sync
- 100M+
- records
Adopted by fast-scaling companies moving mission-critical data in real time
Case study
Migrated from MuleSoft
Case study
Migrated from Celigo
Migrated from Heroku Connect
Migrated from Matillion
Case study
Migrated from Fivetran
Case study
Migrated from Celigo
Object catalog
What Stacksync syncs in Splunk.
These objects sync between Splunk and any connected system, with field-level mapping and conflict resolution. Custom fields are picked up from the live schema where Splunk exposes them.
- Search Results
- SPL searches dispatched via POST /services/search/jobs return a search ID (SID); results are pulled from /services/search/jobs/{sid}/results once the job completes, or synchronously via oneshot/export mode. The primary read path for streaming indexed events out to a warehouse.
- Saved Searches
- Scheduled searches, reports, and the definitions behind alerts at /services/saved/searches with full create, update, and delete. Read out for governance and coverage review, or provisioned and updated from a config source.
- Fired Alerts
- Triggered alert instances listed at /services/alerts/fired_alerts; alert configuration (conditions, schedule, actions) lives on the corresponding saved search. Landed in a database for alert-trend and detection-coverage reporting.
- KV Store Collections
- App-scoped, MongoDB-backed key-value collections at /servicesNS/{owner}/{app}/storage/collections/data/{collection} with full CRUD and batch endpoints. Genuinely bidirectional lookup/state store — read records out or write records in.
- Indexes
- Index inventory and settings (retention, max size, event counts) via /services/data/indexes, with create and edit; loaded into a database for capacity, retention, and data-onboarding tracking.
- HTTP Event Collector
- The write-in path: POST events and metrics to /services/collector (port 8088, or 443 on Splunk Cloud) authenticated with a per-input HEC token, so external records are indexed alongside logs for search and correlation.
- Users and Roles
- Accounts at /services/authentication/users and role/capability definitions at /services/authorization/roles, with full CRUD; exported for access reviews or provisioned from an identity source of truth.
- Dashboards
- Simple XML dashboard and view definitions at /servicesNS/{owner}/{app}/data/ui/views; exported for backup and audit, or created and updated programmatically from version control.
API surface
How Stacksync connects to Splunk.
The connector runs on Splunk's native API. Stacksync manages authentication, rate limits, retries, and schema changes so your team does not maintain integration code.
- Connection
- REST API (management API + HTTP Event Collector)
- Authentication
- HTTP Basic (username/password), or a session key from POST /services/auth/login sent as Authorization: Splunk <key>, or a bearer authentication token (Authorization: Bearer <token>). The HTTP Event Collector uses its own per-input token (Authorization: Splunk <hec-token>). Management API defaults to port 8089; HEC to port 8088 (443 on Splunk Cloud).
- Change detection
- Time-range searches over indexed events (earliest/latest on _time or _indextime); events are immutable once indexed, so incremental extraction advances a time cursor rather than a modified-date CDC feed. Config objects such as saved searches and KV Store are polled; alerts can push via a saved-search webhook action.
- Rate limits
- The management REST API throttles through search-concurrency quotas — max concurrent searches per user and role, plus per-CPU historical search limits in limits.conf — rather than a fixed per-request rate; exceeding quota queues or blocks jobs. HEC has per-token and per-instance throughput limits, and Splunk Cloud adds ingestion and API limits on top.
Sync directions
- Read Supported
- Write Supported
- Change data capture Not available
- Webhooks Supported
What ships with Splunk
Connect Splunk for flexible, real-time data sync.
Real-time sync, workflow automation, event queues, EDI, and monitoring, for every connection.
No-code + pro-code
Workflow automation
Trigger automated workflows whenever Splunk data changes, update records, fire webhooks, or kick off sequences without brittle API scripts.
At scale
Event queues
Handle millions of events per minute without losing a single Splunk record.
Observability
Monitoring
Track your Splunk sync health, view errors, and replay failed events in one click.
Trading partners
EDI
Transform legacy EDI complexity into simple database interactions.
Use cases
What teams run on the Splunk connector.
Splunk is the system of record for machine data in security and IT operations — logs, metrics, and events indexed for search, alerting, and dashboards, owned by SOC analysts, SREs, and Splunk admins. Its APIs run both ways: teams run SPL searches and read fired alerts, saved searches, indexes, and KV Store data out for retention and reporting, and also push events in through the HTTP Event Collector and create or update saved searches, alerts, dashboards, and KV Store records over the management REST API.
- Security engineers / SOC analysts
- SRE / observability engineers
- Splunk administrators
- DevOps engineers
- IT operations / compliance
Stream the results of scheduled SPL searches into Snowflake or BigQuery to retain and analyze indexed events beyond Splunk's index retention window.
Sync fired-alert history and saved-search definitions into Postgres so security and reliability teams query alert trends and detection coverage in SQL.
Ingest application, CRM, or database records into Splunk via the HTTP Event Collector so operational data lands alongside logs for correlation and dashboards.
Read and write KV Store collections to keep Splunk lookups — asset inventories, allow/deny lists, enrichment tables — in sync with an external source of truth in both directions.
Provision and update Saved Searches, alerts, and Dashboards from a Git-backed config repository so detections and reports stay versioned and consistent across search heads.
Export Users and Roles into an IAM database for periodic access reviews, or provision them from an identity source of truth.
All Splunk integrations
Pick the system you need to keep in sync with Splunk. Each page covers the sync setup, field mapping, and common workflows for that pair.
No integrations match .
CRM · 45
-
Splunk ⇄ 6sense -
Splunk ⇄ Affinity -
Splunk ⇄ Apollo.io -
Splunk ⇄ Attio -
Splunk ⇄ Chorusai -
Splunk ⇄ Clari -
Splunk ⇄ Clearbit -
Splunk ⇄ Close -
Splunk ⇄ Copper CRM -
Splunk ⇄ Creatio CRM -
Splunk ⇄ DealCloud -
Splunk ⇄ Dun And Bradstreet -
Splunk ⇄ Folk CRM -
Splunk ⇄ Freshsales -
Splunk ⇄ Freshworks CRM -
Splunk ⇄ Gladly -
Splunk ⇄ Gong -
Splunk ⇄ Gorgias -
Splunk ⇄ HubSpot -
Splunk ⇄ Infor CRM -
Splunk ⇄ Insightly -
Splunk ⇄ Intercom -
Splunk ⇄ Kommo -
Splunk ⇄ Kustomer -
Splunk ⇄ Microsoft Dynamics 365 Sales -
Splunk ⇄ Nimble -
Splunk ⇄ Nutshell -
Splunk ⇄ Oracle CX Sales -
Splunk ⇄ Outreach -
Splunk ⇄ Pipedrive -
Splunk ⇄ Salesforce -
Splunk ⇄ Salesloft -
Splunk ⇄ SAP Sales Cloud -
Splunk ⇄ Seismic -
Splunk ⇄ Shopify -
Splunk ⇄ Streak CRM -
Splunk ⇄ SugarCRM -
Splunk ⇄ Twenty CRM -
Splunk ⇄ Veeva CRM -
Splunk ⇄ Vitally -
Splunk ⇄ Vtiger CRM -
Splunk ⇄ Xactly -
Splunk ⇄ Zoho CRM -
Splunk ⇄ Zoho SalesIQ -
Splunk ⇄ ZoomInfo
ERP · 38
-
Splunk ⇄ Acumatica -
Splunk ⇄ Blue Yonder WMS -
Splunk ⇄ Brightpearl -
Splunk ⇄ Cin7 - Splunk ⇄ DEAR Inventory
-
Splunk ⇄ Dynamics 365 Business Central -
Splunk ⇄ Dynamics 365 F&O -
Splunk ⇄ Epicor ERP -
Splunk ⇄ Extensiv (3PL Central) -
Splunk ⇄ Fishbowl Manufacturing - Splunk ⇄ Infor CloudSuite
- Splunk ⇄ Infor LN
- Splunk ⇄ Infor M3
- Splunk ⇄ Infor WMS
-
Splunk ⇄ Linnworks -
Splunk ⇄ Logiwa WMS -
Splunk ⇄ Macola ERP -
Splunk ⇄ Manhattan Associates WMS -
Splunk ⇄ Microsoft Dynamics GP - Splunk ⇄ Microsoft Dynamics NAV
-
Splunk ⇄ NetSuite -
Splunk ⇄ Odoo -
Splunk ⇄ Oracle Fusion ERP -
Splunk ⇄ Plex ERP -
Splunk ⇄ QAD ERP -
Splunk ⇄ Rootstock ERP -
Splunk ⇄ Sage 100 - Splunk ⇄ Sage 300
- Splunk ⇄ Sage Intacct
- Splunk ⇄ Sage X3
-
Splunk ⇄ SAP -
Splunk ⇄ SAP Business ByDesign -
Splunk ⇄ SAP Business One - Splunk ⇄ SAP S/4HANA
- Splunk ⇄ SuiteAnalytics
-
Splunk ⇄ Syspro -
Splunk ⇄ TikTok Shop -
Splunk ⇄ Unleashed Software
Database · 50
-
Splunk ⇄ Airtable -
Splunk ⇄ Amazon Aurora -
Splunk ⇄ Amazon DynamoDB -
Splunk ⇄ Amazon Lightsail -
Splunk ⇄ Amazon RDS -
Splunk ⇄ Apache Cassandra -
Splunk ⇄ AWS Aurora MySQL - Splunk ⇄ AWS Aurora PostgreSQL
-
Splunk ⇄ Azure Cosmos DB -
Splunk ⇄ Azure SQL Database -
Splunk ⇄ Citus -
Splunk ⇄ CockroachDB -
Splunk ⇄ Couchbase -
Splunk ⇄ DuckDB -
Splunk ⇄ Dynamo DB -
Splunk ⇄ Elasticsearch -
Splunk ⇄ Firebase -
Splunk ⇄ Google AlloyDB -
Splunk ⇄ Google Cloud Spanner - Splunk ⇄ Google Cloud SQL
-
Splunk ⇄ IBM AS/400 - Splunk ⇄ IBM Db2
-
Splunk ⇄ IBM Informix -
Splunk ⇄ InfluxDB -
Splunk ⇄ InterSystems IRIS -
Splunk ⇄ Jdbc -
Splunk ⇄ MariaDB -
Splunk ⇄ MarkLogic -
Splunk ⇄ MongoDB -
Splunk ⇄ MySQL -
Splunk ⇄ Neo4j - Splunk ⇄ OCI Database (Oracle Cloud)
-
Splunk ⇄ OpenSearch -
Splunk ⇄ Oracle DB -
Splunk ⇄ Postgres Heroku -
Splunk ⇄ PostgreSQL -
Splunk ⇄ RavenDB -
Splunk ⇄ Redis Enterprise -
Splunk ⇄ Reltio -
Splunk ⇄ Render Postgres -
Splunk ⇄ SAP ASE (Sybase) -
Splunk ⇄ SAP Hana -
Splunk ⇄ Scaleway Postgres -
Splunk ⇄ SingleStore -
Splunk ⇄ SQL Server -
Splunk ⇄ Supabase -
Splunk ⇄ TiDB -
Splunk ⇄ TimescaleDB -
Splunk ⇄ VoltDB -
Splunk ⇄ YugabyteDB
Data warehouse · 29
- Splunk ⇄ Amazon Redshift
-
Splunk ⇄ Apache Doris -
Splunk ⇄ Apache Druid -
Splunk ⇄ Apache Hive -
Splunk ⇄ Apache Impala -
Splunk ⇄ Apache Kylin -
Splunk ⇄ Apache Pinot -
Splunk ⇄ AWS S3 -
Splunk ⇄ Azure Synapse Analytics -
Splunk ⇄ BigQuery -
Splunk ⇄ ClickHouse -
Splunk ⇄ Cloudera Data Platform -
Splunk ⇄ Databricks -
Splunk ⇄ Dremio -
Splunk ⇄ Exasol -
Splunk ⇄ Firebolt - Splunk ⇄ Google Cloud Platform
-
Splunk ⇄ Greenplum - Splunk ⇄ IBM Netezza
-
Splunk ⇄ Materialize -
Splunk ⇄ MotherDuck -
Splunk ⇄ Rockset -
Splunk ⇄ Snowflake -
Splunk ⇄ Starburst Enterprise -
Splunk ⇄ StarRocks -
Splunk ⇄ Teradata Vantage -
Splunk ⇄ Tinybird -
Splunk ⇄ Vertica -
Splunk ⇄ Yellowbrick
Accounting and finance · 17
How it works
Set up Splunk in minutes, without APIs.
Configure and sync within minutes, no code. Whether you sync 50k or 100M+ records, Stacksync handles the queues, infra, and plumbing. Integrations are non-invasive and need zero setup on your systems.
- 01
Connect your apps
Authenticate Splunk with its native method — OAuth, API keys, or service accounts — plus secure options like SSH tunneling, IP whitelisting, and VPC peering.
Splunk
connected
OAuth 2.0SSH tunnelSSL certificateVPC peering - 02
Choose tables
Pick the Splunk objects to sync — Stacksync auto-detects the schema, including custom fields where the platform exposes them. Sync to existing tables, or let Stacksync create new ones with ideal data types.
objects · SplunkCustomers 12,480Sales Orders 8,213Invoices 5,902Items 1,344 - 03
Map fields
Fields map automatically even when names and types differ. Stacksync handles transformation and type casting for you, zero configuration required.
Splunk databaseCompany company_name textEmail email textAmount amount numericCreated created_at timestamp
FAQ
Splunk connector FAQ
What can I sync with the Splunk connector?
Splunk's core objects — Search Results, Saved Searches, Fired Alerts, KV Store Collections and custom fields — can sync with any of 302 other systems. Every integration is real-time and bidirectional, with field-level mapping and conflict resolution.
How does Stacksync connect to Splunk?
Via REST API (management API + HTTP Event Collector), authenticated with HTTP Basic (username/password), or a session key from POST /services/auth/login sent as Authorization: Splunk <key>, or a bearer authentication token (Authorization: Bearer <token>). The HTTP Event Collector uses its own per-input token (Authorization: Splunk <hec-token>). Management API defaults to port 8089; HEC to port 8088 (443 on Splunk Cloud).. Changes are detected as follows — time-range searches over indexed events (earliest/latest on _time or _indextime); events are immutable once indexed, so incremental extraction advances a time cursor rather than a modified-date CDC feed. Config objects such as saved searches and KV Store are polled; alerts can push via a saved-search webhook action.. Stacksync manages rate limits, retries, and schema changes automatically.
Is the Splunk connector two-way?
Yes. Changes made in Splunk propagate to the connected system and vice versa, in milliseconds. One-way flows are also supported when a direction should stay read-only.
How long does a Splunk integration take to set up?
Most Splunk integrations go live in minutes: authenticate Splunk and the other system, pick objects and fields, and enable the sync. No code and no infrastructure to manage.
Is Splunk data secure in transit?
Stacksync is SOC 2 Type II, ISO 27001, GDPR and HIPAA compliant. Splunk data is encrypted in transit, and a zero-persistent-storage architecture means records are not retained after a sync operation.
SECURITY
Security teams trust Stacksync
As a data company, we understand the importance of keeping your data secure. Stacksync is built with security best practices to keep your data safe at every layer, and is DPF-certified for US, EU, UK and CH data transfers.
SOC 2 Type II
ISO 27001
HIPAA BAA
GDPR
CCPA
DPF US-EU-UK-CH
→ SECURITY WITH BENEFITS
SSO & SCIM
Let your users access Stacksync from your centralized user management systems. Works with Okta, Azure, Google SSO and more.
Alerts
Immediately get alerted about record syncing issues over email, Slack, PagerDuty and WhatsApp. Resolve issues from a centralized dashboard with retry and revert options.
Secure connection options
Securely connects to your systems with:
