It seems your requirement is for Splunk to hold some credentials for a remote server, so that a query can remotely execute (over ssh) a command on the remote target?
If i have understood this, then firstly I would caution that this is a bad use case, and would very strongly advise against Splunk persisting credentials which can be used to access remote hosts.
A better solution (imo) would be to deploy a UF to each target host and have that UF run the script on a schedule to collect the same information.
Your use case may have specific reasons why you have not considered this so far, but the idea of using Splunk to manage remote ssh credentials should be avoided.
... View more