Splunk Cloud Search Head API access

[ashrafsj2612]

Hi All,

We are migrating from Splunk On-prem to Splunk Cloud, as part of it we want to have the SH API access. I have got the IP's that needs to be whitelisted from dev and have added them to SH API allow list. They are using service accounts to make changes to their alerts/dashboards etc. 

Does service account if migrated to Splunk cloud and maintained as local account work with Splunk Cloud SH API access? I read in docs it said I need to create authentication token after whitelisting IP's? is that the case, any one else has had same issues. 

Dev also mentioned while using Splunk On-prem they whitelisted 10.0.0.0/8 on port 8089. I dont think that will work, should they whitelist public IP's corresponding to the splunk cloud URL?

Thanks in advance!

[ww9rivers]

Local accounts in Splunk Cloud with tokens work for search head API access. With "service account", I guess you mean to run unattended API actions. Token is the way to go for authentication.

Not sure why you would need to white-list the Splunk Cloud IPs on-prem. You would initiate connection from on-prem server(s) to search heads in the Splunk Cloud. Right? I think you would only need white-list your corporate public IPs in the Splunk Cloud.