Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Splunk Provider
  4. API Docs
  5. FederatedIndexes
Viewing docs for Splunk v1.4.4
published on Wednesday, Sep 23, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-splunk

splunk.FederatedIndexes

splunk logo splunk logo
Viewing docs for Splunk v1.4.4
published on Wednesday, Sep 23, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-splunk

    # Resource: splunk.FederatedIndexes

    Creates and manages a local federated index that maps to a dataset on a federated provider.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as splunk from "@pulumi/splunk";

const remoteMain = new splunk.FederatedIndexes("remote_main", {
    name: "remote-main",
    federatedProvider: remote.name,
    datasetType: "index",
    datasetName: "main",
});

    import pulumi
import pulumi_splunk as splunk

remote_main = splunk.FederatedIndexes("remote_main",
    name="remote-main",
    federated_provider=remote["name"],
    dataset_type="index",
    dataset_name="main")

    package main

import (
	"github.com/pulumi/pulumi-splunk/sdk/go/splunk"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := splunk.NewFederatedIndexes(ctx, "remote_main", &splunk.FederatedIndexesArgs{
			Name:              pulumi.String("remote-main"),
			FederatedProvider: pulumi.Any(remote.Name),
			DatasetType:       pulumi.String("index"),
			DatasetName:       pulumi.String("main"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Splunk = Pulumi.Splunk;

return await Deployment.RunAsync(() => 
{
    var remoteMain = new Splunk.FederatedIndexes("remote_main", new()
    {
        Name = "remote-main",
        FederatedProvider = remote.Name,
        DatasetType = "index",
        DatasetName = "main",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.splunk.FederatedIndexes;
import com.pulumi.splunk.FederatedIndexesArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var remoteMain = new FederatedIndexes("remoteMain", FederatedIndexesArgs.builder()
            .name("remote-main")
            .federatedProvider(remote.name())
            .datasetType("index")
            .datasetName("main")
            .build());

    }
}

    resources:
  remoteMain:
    type: splunk:FederatedIndexes
    name: remote_main
    properties:
      name: remote-main
      federatedProvider: ${remote.name}
      datasetType: index
      datasetName: main

    pulumi {
  required_providers {
    splunk = {
      source = "pulumi/splunk"
    }
  }
}

resource "splunk_federatedindexes" "remote_main" {
  name               = "remote-main"
  federated_provider = remote.name
  dataset_type       = "index"
  dataset_name       = "main"
}

    Create FederatedIndexes Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new FederatedIndexes(name: string, args: FederatedIndexesArgs, opts?: CustomResourceOptions);
    @overload
def FederatedIndexes(resource_name: str,
                     args: FederatedIndexesArgs,
                     opts: Optional[ResourceOptions] = None)

@overload
def FederatedIndexes(resource_name: str,
                     opts: Optional[ResourceOptions] = None,
                     dataset_name: Optional[str] = None,
                     federated_provider: Optional[str] = None,
                     name: Optional[str] = None,
                     dataset_type: Optional[str] = None)
    func NewFederatedIndexes(ctx *Context, name string, args FederatedIndexesArgs, opts ...ResourceOption) (*FederatedIndexes, error)
    public FederatedIndexes(string name, FederatedIndexesArgs args, CustomResourceOptions? opts = null)
    public FederatedIndexes(String name, FederatedIndexesArgs args)
public FederatedIndexes(String name, FederatedIndexesArgs args, CustomResourceOptions options)

    type: splunk:FederatedIndexes
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "splunk_federated_indexes" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args FederatedIndexesArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args FederatedIndexesArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args FederatedIndexesArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args FederatedIndexesArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args FederatedIndexesArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var federatedIndexesResource = new Splunk.FederatedIndexes("federatedIndexesResource", new()
{
    DatasetName = "string",
    FederatedProvider = "string",
    Name = "string",
    DatasetType = "string",
});

    example, err := splunk.NewFederatedIndexes(ctx, "federatedIndexesResource", &splunk.FederatedIndexesArgs{
	DatasetName:       pulumi.String("string"),
	FederatedProvider: pulumi.String("string"),
	Name:              pulumi.String("string"),
	DatasetType:       pulumi.String("string"),
})

    resource "splunk_federated_indexes" "federatedIndexesResource" {
  lifecycle {
    create_before_destroy = true
  }
  dataset_name       = "string"
  federated_provider = "string"
  name               = "string"
  dataset_type       = "string"
}

    var federatedIndexesResource = new FederatedIndexes("federatedIndexesResource", FederatedIndexesArgs.builder()
    .datasetName("string")
    .federatedProvider("string")
    .name("string")
    .datasetType("string")
    .build());

    federated_indexes_resource = splunk.FederatedIndexes("federatedIndexesResource",
    dataset_name="string",
    federated_provider="string",
    name="string",
    dataset_type="string")

    const federatedIndexesResource = new splunk.FederatedIndexes("federatedIndexesResource", {
    datasetName: "string",
    federatedProvider: "string",
    name: "string",
    datasetType: "string",
});

    type: splunk:FederatedIndexes
properties:
    datasetName: string
    datasetType: string
    federatedProvider: string
    name: string

    FederatedIndexes Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The FederatedIndexes resource accepts the following input properties:

    DatasetName string

    Remote index, saved search, scheduled search (for lastjob), or data model name, without a type prefix. For example, use main, not index:main. Changes to either dataset field update the mapping in place.

    Federated indexes require a standard-mode provider. Remote saved searches and data models must be readable by the provider's service account and shared globally or in the provider's app context. See Splunk's remote dataset documentation.

    FederatedProvider string
    Name of the federated provider containing the remote dataset.
    Name string
    Local federated index name without the federated: prefix. Use lowercase letters, numbers, underscores, or hyphens, starting with a letter or number. The name must be at most 2048 characters and must not contain kvstore. Changing it creates a new index.
    DatasetType string
    Remote dataset type. Accepts only index, savedsearch, lastjob, or datamodel. Defaults to index.
    DatasetName string

    Remote index, saved search, scheduled search (for lastjob), or data model name, without a type prefix. For example, use main, not index:main. Changes to either dataset field update the mapping in place.

    Federated indexes require a standard-mode provider. Remote saved searches and data models must be readable by the provider's service account and shared globally or in the provider's app context. See Splunk's remote dataset documentation.

    FederatedProvider string
    Name of the federated provider containing the remote dataset.
    Name string
    Local federated index name without the federated: prefix. Use lowercase letters, numbers, underscores, or hyphens, starting with a letter or number. The name must be at most 2048 characters and must not contain kvstore. Changing it creates a new index.
    DatasetType string
    Remote dataset type. Accepts only index, savedsearch, lastjob, or datamodel. Defaults to index.
    dataset_name string

    Remote index, saved search, scheduled search (for lastjob), or data model name, without a type prefix. For example, use main, not index:main. Changes to either dataset field update the mapping in place.

    Federated indexes require a standard-mode provider. Remote saved searches and data models must be readable by the provider's service account and shared globally or in the provider's app context. See Splunk's remote dataset documentation.

    federated_provider string
    Name of the federated provider containing the remote dataset.
    name string
    Local federated index name without the federated: prefix. Use lowercase letters, numbers, underscores, or hyphens, starting with a letter or number. The name must be at most 2048 characters and must not contain kvstore. Changing it creates a new index.
    dataset_type string
    Remote dataset type. Accepts only index, savedsearch, lastjob, or datamodel. Defaults to index.
    datasetName String

    Remote index, saved search, scheduled search (for lastjob), or data model name, without a type prefix. For example, use main, not index:main. Changes to either dataset field update the mapping in place.

    Federated indexes require a standard-mode provider. Remote saved searches and data models must be readable by the provider's service account and shared globally or in the provider's app context. See Splunk's remote dataset documentation.

    federatedProvider String
    Name of the federated provider containing the remote dataset.
    name String
    Local federated index name without the federated: prefix. Use lowercase letters, numbers, underscores, or hyphens, starting with a letter or number. The name must be at most 2048 characters and must not contain kvstore. Changing it creates a new index.
    datasetType String
    Remote dataset type. Accepts only index, savedsearch, lastjob, or datamodel. Defaults to index.
    datasetName string

    Remote index, saved search, scheduled search (for lastjob), or data model name, without a type prefix. For example, use main, not index:main. Changes to either dataset field update the mapping in place.

    Federated indexes require a standard-mode provider. Remote saved searches and data models must be readable by the provider's service account and shared globally or in the provider's app context. See Splunk's remote dataset documentation.

    federatedProvider string
    Name of the federated provider containing the remote dataset.
    name string
    Local federated index name without the federated: prefix. Use lowercase letters, numbers, underscores, or hyphens, starting with a letter or number. The name must be at most 2048 characters and must not contain kvstore. Changing it creates a new index.
    datasetType string
    Remote dataset type. Accepts only index, savedsearch, lastjob, or datamodel. Defaults to index.
    dataset_name str

    Remote index, saved search, scheduled search (for lastjob), or data model name, without a type prefix. For example, use main, not index:main. Changes to either dataset field update the mapping in place.

    Federated indexes require a standard-mode provider. Remote saved searches and data models must be readable by the provider's service account and shared globally or in the provider's app context. See Splunk's remote dataset documentation.

    federated_provider str
    Name of the federated provider containing the remote dataset.
    name str
    Local federated index name without the federated: prefix. Use lowercase letters, numbers, underscores, or hyphens, starting with a letter or number. The name must be at most 2048 characters and must not contain kvstore. Changing it creates a new index.
    dataset_type str
    Remote dataset type. Accepts only index, savedsearch, lastjob, or datamodel. Defaults to index.
    datasetName String

    Remote index, saved search, scheduled search (for lastjob), or data model name, without a type prefix. For example, use main, not index:main. Changes to either dataset field update the mapping in place.

    Federated indexes require a standard-mode provider. Remote saved searches and data models must be readable by the provider's service account and shared globally or in the provider's app context. See Splunk's remote dataset documentation.

    federatedProvider String
    Name of the federated provider containing the remote dataset.
    name String
    Local federated index name without the federated: prefix. Use lowercase letters, numbers, underscores, or hyphens, starting with a letter or number. The name must be at most 2048 characters and must not contain kvstore. Changing it creates a new index.
    datasetType String
    Remote dataset type. Accepts only index, savedsearch, lastjob, or datamodel. Defaults to index.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the FederatedIndexes resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing FederatedIndexes Resource

    Get an existing FederatedIndexes resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: FederatedIndexesState, opts?: CustomResourceOptions): FederatedIndexes
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        dataset_name: Optional[str] = None,
        dataset_type: Optional[str] = None,
        federated_provider: Optional[str] = None,
        name: Optional[str] = None) -> FederatedIndexes
    func GetFederatedIndexes(ctx *Context, name string, id IDInput, state *FederatedIndexesState, opts ...ResourceOption) (*FederatedIndexes, error)
    public static FederatedIndexes Get(string name, Input<string> id, FederatedIndexesState? state, CustomResourceOptions? opts = null)
    public static FederatedIndexes get(String name, Output<String> id, FederatedIndexesState state, CustomResourceOptions options)
    resources:  _:    type: splunk:FederatedIndexes    get:      id: ${id}
    import {
  to = splunk_federated_indexes.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    DatasetName string

    Remote index, saved search, scheduled search (for lastjob), or data model name, without a type prefix. For example, use main, not index:main. Changes to either dataset field update the mapping in place.

    Federated indexes require a standard-mode provider. Remote saved searches and data models must be readable by the provider's service account and shared globally or in the provider's app context. See Splunk's remote dataset documentation.

    DatasetType string
    Remote dataset type. Accepts only index, savedsearch, lastjob, or datamodel. Defaults to index.
    FederatedProvider string
    Name of the federated provider containing the remote dataset.
    Name string
    Local federated index name without the federated: prefix. Use lowercase letters, numbers, underscores, or hyphens, starting with a letter or number. The name must be at most 2048 characters and must not contain kvstore. Changing it creates a new index.
    DatasetName string

    Remote index, saved search, scheduled search (for lastjob), or data model name, without a type prefix. For example, use main, not index:main. Changes to either dataset field update the mapping in place.

    Federated indexes require a standard-mode provider. Remote saved searches and data models must be readable by the provider's service account and shared globally or in the provider's app context. See Splunk's remote dataset documentation.

    DatasetType string
    Remote dataset type. Accepts only index, savedsearch, lastjob, or datamodel. Defaults to index.
    FederatedProvider string
    Name of the federated provider containing the remote dataset.
    Name string
    Local federated index name without the federated: prefix. Use lowercase letters, numbers, underscores, or hyphens, starting with a letter or number. The name must be at most 2048 characters and must not contain kvstore. Changing it creates a new index.
    dataset_name string

    Remote index, saved search, scheduled search (for lastjob), or data model name, without a type prefix. For example, use main, not index:main. Changes to either dataset field update the mapping in place.

    Federated indexes require a standard-mode provider. Remote saved searches and data models must be readable by the provider's service account and shared globally or in the provider's app context. See Splunk's remote dataset documentation.

    dataset_type string
    Remote dataset type. Accepts only index, savedsearch, lastjob, or datamodel. Defaults to index.
    federated_provider string
    Name of the federated provider containing the remote dataset.
    name string
    Local federated index name without the federated: prefix. Use lowercase letters, numbers, underscores, or hyphens, starting with a letter or number. The name must be at most 2048 characters and must not contain kvstore. Changing it creates a new index.
    datasetName String

    Remote index, saved search, scheduled search (for lastjob), or data model name, without a type prefix. For example, use main, not index:main. Changes to either dataset field update the mapping in place.

    Federated indexes require a standard-mode provider. Remote saved searches and data models must be readable by the provider's service account and shared globally or in the provider's app context. See Splunk's remote dataset documentation.

    datasetType String
    Remote dataset type. Accepts only index, savedsearch, lastjob, or datamodel. Defaults to index.
    federatedProvider String
    Name of the federated provider containing the remote dataset.
    name String
    Local federated index name without the federated: prefix. Use lowercase letters, numbers, underscores, or hyphens, starting with a letter or number. The name must be at most 2048 characters and must not contain kvstore. Changing it creates a new index.
    datasetName string

    Remote index, saved search, scheduled search (for lastjob), or data model name, without a type prefix. For example, use main, not index:main. Changes to either dataset field update the mapping in place.

    Federated indexes require a standard-mode provider. Remote saved searches and data models must be readable by the provider's service account and shared globally or in the provider's app context. See Splunk's remote dataset documentation.

    datasetType string
    Remote dataset type. Accepts only index, savedsearch, lastjob, or datamodel. Defaults to index.
    federatedProvider string
    Name of the federated provider containing the remote dataset.
    name string
    Local federated index name without the federated: prefix. Use lowercase letters, numbers, underscores, or hyphens, starting with a letter or number. The name must be at most 2048 characters and must not contain kvstore. Changing it creates a new index.
    dataset_name str

    Remote index, saved search, scheduled search (for lastjob), or data model name, without a type prefix. For example, use main, not index:main. Changes to either dataset field update the mapping in place.

    Federated indexes require a standard-mode provider. Remote saved searches and data models must be readable by the provider's service account and shared globally or in the provider's app context. See Splunk's remote dataset documentation.

    dataset_type str
    Remote dataset type. Accepts only index, savedsearch, lastjob, or datamodel. Defaults to index.
    federated_provider str
    Name of the federated provider containing the remote dataset.
    name str
    Local federated index name without the federated: prefix. Use lowercase letters, numbers, underscores, or hyphens, starting with a letter or number. The name must be at most 2048 characters and must not contain kvstore. Changing it creates a new index.
    datasetName String

    Remote index, saved search, scheduled search (for lastjob), or data model name, without a type prefix. For example, use main, not index:main. Changes to either dataset field update the mapping in place.

    Federated indexes require a standard-mode provider. Remote saved searches and data models must be readable by the provider's service account and shared globally or in the provider's app context. See Splunk's remote dataset documentation.

    datasetType String
    Remote dataset type. Accepts only index, savedsearch, lastjob, or datamodel. Defaults to index.
    federatedProvider String
    Name of the federated provider containing the remote dataset.
    name String
    Local federated index name without the federated: prefix. Use lowercase letters, numbers, underscores, or hyphens, starting with a letter or number. The name must be at most 2048 characters and must not contain kvstore. Changing it creates a new index.

    Import

    Import using the short name or the full Splunk index name. In either case, set name = "remote-main" in configuration:

    $ pulumi import splunk:index/federatedIndexes:FederatedIndexes remote_main federated:remote-main

    Alternatively:

    $ pulumi import splunk:index/federatedIndexes:FederatedIndexes remote_main remote-main

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Splunk pulumi/pulumi-splunk
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the splunk Terraform Provider.
    splunk logo splunk logo
    Viewing docs for Splunk v1.4.4
    published on Wednesday, Sep 23, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-splunk

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial