For the Splunk extension you will need to enable eAPI on the switch and provide a user with access to eAPI. You can enable eAPI by the following configuration on the switch: management api http-commands no shutdown To configure a user you can use: username <user> secret <pass> Then specify this user and password in the splunk-forwarder configuration: splunk-forwarder http-commands username <name> http-commands secret <passphrase> Alternatively you can use UNIX sockets which eliminates the need for a user configured by specifying the following in the splunk-forwarder configuration: splunk-forwarder http-commands protocol socket ... View more