Brightpearl to Splunk integration — real-time, two-way sync

Yes. Stacksync provides a managed, real-time two-way integration between Brightpearl and Splunk: authenticate both systems, choose the objects to sync (such as Brightpearl's Invoices and payments and Custom fields), map fields visually, and changes propagate both ways in milliseconds — no code required.

Change detection on Brightpearl: Webhooks for object created/updated events, with resource search polling as a fallback. On Splunk: Time-range searches over indexed events (earliest/latest on _time or _indextime); events are immutable once indexed, so incremental extraction advances a time cursor rather than a modified-date CDC feed. Config objects such as saved searches and KV Store are polled; alerts can push via a saved-search webhook action. Each detected change propagates to the other side in milliseconds, with field-level conflict resolution and an inspectable event log.

On the Splunk side: KV Store Collections, Indexes, HTTP Event Collector, Users and Roles, plus custom fields where Splunk exposes them. On the Brightpearl side: Products, Sales orders, Purchase orders, Contacts. Stacksync auto-detects both schemas and converts types between the two systems.

Yes. Each object mapping can be bidirectional or restricted to a single direction (both systems accept writes). Read-only mirrors, one-way pushes, and full two-way sync can be mixed in the same integration.

Common patterns for Brightpearl and Splunk: Where Brightpearl runs operations: inventory and fulfillment metrics; Where Brightpearl is the HR system of record: workforce and cost analysis; Write-back where Brightpearl exposes writable fields: segments and scores return. Operational records from Brightpearl become measurable in Splunk, joinable with the rest of what the company tracks for supply and fulfillment reporting.

Brightpearl: REST API, organized into services (order, product, contact, warehouse, accounting). Authentication: OAuth 2.0 (authorization code grant) for current apps; legacy private and public apps authenticate with app reference and account token headers. Splunk: REST API (management API + HTTP Event Collector). Authentication: HTTP Basic (username/password), or a session key from POST /services/auth/login sent as Authorization: Splunk <key>, or a bearer authentication token (Authorization: Bearer <token>). The HTTP Event Collector uses its own per-input token (Authorization: Splunk <hec-token>). Management API defaults to port 8089; HEC to port 8088 (443 on Splunk Cloud). Stacksync manages authentication, retries, and rate limits on both sides.