Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Splunk Provider
  4. API Docs
  5. FederatedProviders
Viewing docs for Splunk v1.4.4
published on Wednesday, Sep 23, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-splunk

splunk.FederatedProviders

splunk logo splunk logo
Viewing docs for Splunk v1.4.4
published on Wednesday, Sep 23, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-splunk

    # Resource: splunk.FederatedProviders

    Creates and manages a Splunk-to-Splunk federated search provider on a Splunk Enterprise search head.

    The provider definition is stored in the local deployment’s federated.conf. It requires an account on the remote deployment that is dedicated to federated searching.

    Security

    Use a dedicated, least-privileged remote service account and a trusted TLS certificate on both Splunk management endpoints. For production Terraform provider connections, set insecureSkipVerify = false. This resource stores a SHA-256 password hash in state. Protect state and saved plans: hashes permit offline password guessing, and saved plans can contain the configured plaintext password. Historical state from earlier builds may still contain plaintext passwords.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as splunk from "@pulumi/splunk";

const remote = new splunk.FederatedProviders("remote", {
    name: "remote-splunk",
    hostPort: "remote-splunk:8089",
    serviceAccount: "federated_search",
    password: remoteSplunkPassword,
    mode: "standard",
    appContext: "search",
});

    import pulumi
import pulumi_splunk as splunk

remote = splunk.FederatedProviders("remote",
    name="remote-splunk",
    host_port="remote-splunk:8089",
    service_account="federated_search",
    password=remote_splunk_password,
    mode="standard",
    app_context="search")

    package main

import (
	"github.com/pulumi/pulumi-splunk/sdk/go/splunk"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := splunk.NewFederatedProviders(ctx, "remote", &splunk.FederatedProvidersArgs{
			Name:           pulumi.String("remote-splunk"),
			HostPort:       pulumi.String("remote-splunk:8089"),
			ServiceAccount: pulumi.String("federated_search"),
			Password:       pulumi.Any(remoteSplunkPassword),
			Mode:           pulumi.String("standard"),
			AppContext:     pulumi.String("search"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Splunk = Pulumi.Splunk;

return await Deployment.RunAsync(() => 
{
    var remote = new Splunk.FederatedProviders("remote", new()
    {
        Name = "remote-splunk",
        HostPort = "remote-splunk:8089",
        ServiceAccount = "federated_search",
        Password = remoteSplunkPassword,
        Mode = "standard",
        AppContext = "search",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.splunk.FederatedProviders;
import com.pulumi.splunk.FederatedProvidersArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var remote = new FederatedProviders("remote", FederatedProvidersArgs.builder()
            .name("remote-splunk")
            .hostPort("remote-splunk:8089")
            .serviceAccount("federated_search")
            .password(remoteSplunkPassword)
            .mode("standard")
            .appContext("search")
            .build());

    }
}

    resources:
  remote:
    type: splunk:FederatedProviders
    properties:
      name: remote-splunk
      hostPort: remote-splunk:8089
      serviceAccount: federated_search
      password: ${remoteSplunkPassword}
      mode: standard
      appContext: search

    pulumi {
  required_providers {
    splunk = {
      source = "pulumi/splunk"
    }
  }
}

resource "splunk_federatedproviders" "remote" {
  name            = "remote-splunk"
  host_port       = "remote-splunk:8089"
  service_account = "federated_search"
  password        = remoteSplunkPassword
  mode            = "standard"
  app_context     = "search"
}

    Acceptance testing

    The optional federated acceptance test uses the standard repository acceptance-test variables plus SPLUNK_FEDERATED_PROVIDER_HOST_PORT, SPLUNK_FEDERATED_PROVIDER_USERNAME, and SPLUNK_FEDERATED_PROVIDER_PASSWORD. The remote test deployment must contain the built-in search and launcher apps and the main and _internal indexes. Use a disposable test environment. If any federated credential variable is missing, the test skips with an explanation, including when TF_ACC=1. Existing CI needs no additional secrets, services, or workflow changes. Mocked lifecycle tests run without Splunk or credentials. Ordinary unit-test runs leave TF_ACC unset or empty.

    Create FederatedProviders Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new FederatedProviders(name: string, args: FederatedProvidersArgs, opts?: CustomResourceOptions);
    @overload
def FederatedProviders(resource_name: str,
                       args: FederatedProvidersArgs,
                       opts: Optional[ResourceOptions] = None)

@overload
def FederatedProviders(resource_name: str,
                       opts: Optional[ResourceOptions] = None,
                       host_port: Optional[str] = None,
                       name: Optional[str] = None,
                       password: Optional[str] = None,
                       service_account: Optional[str] = None,
                       app_context: Optional[str] = None,
                       mode: Optional[str] = None)
    func NewFederatedProviders(ctx *Context, name string, args FederatedProvidersArgs, opts ...ResourceOption) (*FederatedProviders, error)
    public FederatedProviders(string name, FederatedProvidersArgs args, CustomResourceOptions? opts = null)
    public FederatedProviders(String name, FederatedProvidersArgs args)
public FederatedProviders(String name, FederatedProvidersArgs args, CustomResourceOptions options)

    type: splunk:FederatedProviders
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "splunk_federated_providers" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args FederatedProvidersArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args FederatedProvidersArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args FederatedProvidersArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args FederatedProvidersArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args FederatedProvidersArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var federatedProvidersResource = new Splunk.FederatedProviders("federatedProvidersResource", new()
{
    HostPort = "string",
    Name = "string",
    Password = "string",
    ServiceAccount = "string",
    AppContext = "string",
    Mode = "string",
});

    example, err := splunk.NewFederatedProviders(ctx, "federatedProvidersResource", &splunk.FederatedProvidersArgs{
	HostPort:       pulumi.String("string"),
	Name:           pulumi.String("string"),
	Password:       pulumi.String("string"),
	ServiceAccount: pulumi.String("string"),
	AppContext:     pulumi.String("string"),
	Mode:           pulumi.String("string"),
})

    resource "splunk_federated_providers" "federatedProvidersResource" {
  lifecycle {
    create_before_destroy = true
  }
  host_port       = "string"
  name            = "string"
  password        = "string"
  service_account = "string"
  app_context     = "string"
  mode            = "string"
}

    var federatedProvidersResource = new FederatedProviders("federatedProvidersResource", FederatedProvidersArgs.builder()
    .hostPort("string")
    .name("string")
    .password("string")
    .serviceAccount("string")
    .appContext("string")
    .mode("string")
    .build());

    federated_providers_resource = splunk.FederatedProviders("federatedProvidersResource",
    host_port="string",
    name="string",
    password="string",
    service_account="string",
    app_context="string",
    mode="string")

    const federatedProvidersResource = new splunk.FederatedProviders("federatedProvidersResource", {
    hostPort: "string",
    name: "string",
    password: "string",
    serviceAccount: "string",
    appContext: "string",
    mode: "string",
});

    type: splunk:FederatedProviders
properties:
    appContext: string
    hostPort: string
    mode: string
    name: string
    password: string
    serviceAccount: string

    FederatedProviders Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The FederatedProviders resource accepts the following input properties:

    HostPort string
    Remote Splunk management host and port, such as remote-splunk:8089.
    Name string
    Unique name for the federated provider. Changing it creates a new provider.
    Password string
    Password for the remote service account. State stores its SHA-256 hash. Creation and configured password changes send the original password to Splunk; password changes update the provider in place without replacement. Other updates omit the password. Splunk does not return this secret, so changes made directly in Splunk cannot be detected.
    ServiceAccount string
    Username of the service account on the remote deployment.
    AppContext string
    App on the remote search head used by standard-mode searches. Defaults to search; transparent mode ignores this value.
    Mode string
    Federated search mode: standard (default) or transparent. A local deployment must not mix provider modes.
    HostPort string
    Remote Splunk management host and port, such as remote-splunk:8089.
    Name string
    Unique name for the federated provider. Changing it creates a new provider.
    Password string
    Password for the remote service account. State stores its SHA-256 hash. Creation and configured password changes send the original password to Splunk; password changes update the provider in place without replacement. Other updates omit the password. Splunk does not return this secret, so changes made directly in Splunk cannot be detected.
    ServiceAccount string
    Username of the service account on the remote deployment.
    AppContext string
    App on the remote search head used by standard-mode searches. Defaults to search; transparent mode ignores this value.
    Mode string
    Federated search mode: standard (default) or transparent. A local deployment must not mix provider modes.
    host_port string
    Remote Splunk management host and port, such as remote-splunk:8089.
    name string
    Unique name for the federated provider. Changing it creates a new provider.
    password string
    Password for the remote service account. State stores its SHA-256 hash. Creation and configured password changes send the original password to Splunk; password changes update the provider in place without replacement. Other updates omit the password. Splunk does not return this secret, so changes made directly in Splunk cannot be detected.
    service_account string
    Username of the service account on the remote deployment.
    app_context string
    App on the remote search head used by standard-mode searches. Defaults to search; transparent mode ignores this value.
    mode string
    Federated search mode: standard (default) or transparent. A local deployment must not mix provider modes.
    hostPort String
    Remote Splunk management host and port, such as remote-splunk:8089.
    name String
    Unique name for the federated provider. Changing it creates a new provider.
    password String
    Password for the remote service account. State stores its SHA-256 hash. Creation and configured password changes send the original password to Splunk; password changes update the provider in place without replacement. Other updates omit the password. Splunk does not return this secret, so changes made directly in Splunk cannot be detected.
    serviceAccount String
    Username of the service account on the remote deployment.
    appContext String
    App on the remote search head used by standard-mode searches. Defaults to search; transparent mode ignores this value.
    mode String
    Federated search mode: standard (default) or transparent. A local deployment must not mix provider modes.
    hostPort string
    Remote Splunk management host and port, such as remote-splunk:8089.
    name string
    Unique name for the federated provider. Changing it creates a new provider.
    password string
    Password for the remote service account. State stores its SHA-256 hash. Creation and configured password changes send the original password to Splunk; password changes update the provider in place without replacement. Other updates omit the password. Splunk does not return this secret, so changes made directly in Splunk cannot be detected.
    serviceAccount string
    Username of the service account on the remote deployment.
    appContext string
    App on the remote search head used by standard-mode searches. Defaults to search; transparent mode ignores this value.
    mode string
    Federated search mode: standard (default) or transparent. A local deployment must not mix provider modes.
    host_port str
    Remote Splunk management host and port, such as remote-splunk:8089.
    name str
    Unique name for the federated provider. Changing it creates a new provider.
    password str
    Password for the remote service account. State stores its SHA-256 hash. Creation and configured password changes send the original password to Splunk; password changes update the provider in place without replacement. Other updates omit the password. Splunk does not return this secret, so changes made directly in Splunk cannot be detected.
    service_account str
    Username of the service account on the remote deployment.
    app_context str
    App on the remote search head used by standard-mode searches. Defaults to search; transparent mode ignores this value.
    mode str
    Federated search mode: standard (default) or transparent. A local deployment must not mix provider modes.
    hostPort String
    Remote Splunk management host and port, such as remote-splunk:8089.
    name String
    Unique name for the federated provider. Changing it creates a new provider.
    password String
    Password for the remote service account. State stores its SHA-256 hash. Creation and configured password changes send the original password to Splunk; password changes update the provider in place without replacement. Other updates omit the password. Splunk does not return this secret, so changes made directly in Splunk cannot be detected.
    serviceAccount String
    Username of the service account on the remote deployment.
    appContext String
    App on the remote search head used by standard-mode searches. Defaults to search; transparent mode ignores this value.
    mode String
    Federated search mode: standard (default) or transparent. A local deployment must not mix provider modes.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the FederatedProviders resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing FederatedProviders Resource

    Get an existing FederatedProviders resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: FederatedProvidersState, opts?: CustomResourceOptions): FederatedProviders
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        app_context: Optional[str] = None,
        host_port: Optional[str] = None,
        mode: Optional[str] = None,
        name: Optional[str] = None,
        password: Optional[str] = None,
        service_account: Optional[str] = None) -> FederatedProviders
    func GetFederatedProviders(ctx *Context, name string, id IDInput, state *FederatedProvidersState, opts ...ResourceOption) (*FederatedProviders, error)
    public static FederatedProviders Get(string name, Input<string> id, FederatedProvidersState? state, CustomResourceOptions? opts = null)
    public static FederatedProviders get(String name, Output<String> id, FederatedProvidersState state, CustomResourceOptions options)
    resources:  _:    type: splunk:FederatedProviders    get:      id: ${id}
    import {
  to = splunk_federated_providers.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AppContext string
    App on the remote search head used by standard-mode searches. Defaults to search; transparent mode ignores this value.
    HostPort string
    Remote Splunk management host and port, such as remote-splunk:8089.
    Mode string
    Federated search mode: standard (default) or transparent. A local deployment must not mix provider modes.
    Name string
    Unique name for the federated provider. Changing it creates a new provider.
    Password string
    Password for the remote service account. State stores its SHA-256 hash. Creation and configured password changes send the original password to Splunk; password changes update the provider in place without replacement. Other updates omit the password. Splunk does not return this secret, so changes made directly in Splunk cannot be detected.
    ServiceAccount string
    Username of the service account on the remote deployment.
    AppContext string
    App on the remote search head used by standard-mode searches. Defaults to search; transparent mode ignores this value.
    HostPort string
    Remote Splunk management host and port, such as remote-splunk:8089.
    Mode string
    Federated search mode: standard (default) or transparent. A local deployment must not mix provider modes.
    Name string
    Unique name for the federated provider. Changing it creates a new provider.
    Password string
    Password for the remote service account. State stores its SHA-256 hash. Creation and configured password changes send the original password to Splunk; password changes update the provider in place without replacement. Other updates omit the password. Splunk does not return this secret, so changes made directly in Splunk cannot be detected.
    ServiceAccount string
    Username of the service account on the remote deployment.
    app_context string
    App on the remote search head used by standard-mode searches. Defaults to search; transparent mode ignores this value.
    host_port string
    Remote Splunk management host and port, such as remote-splunk:8089.
    mode string
    Federated search mode: standard (default) or transparent. A local deployment must not mix provider modes.
    name string
    Unique name for the federated provider. Changing it creates a new provider.
    password string
    Password for the remote service account. State stores its SHA-256 hash. Creation and configured password changes send the original password to Splunk; password changes update the provider in place without replacement. Other updates omit the password. Splunk does not return this secret, so changes made directly in Splunk cannot be detected.
    service_account string
    Username of the service account on the remote deployment.
    appContext String
    App on the remote search head used by standard-mode searches. Defaults to search; transparent mode ignores this value.
    hostPort String
    Remote Splunk management host and port, such as remote-splunk:8089.
    mode String
    Federated search mode: standard (default) or transparent. A local deployment must not mix provider modes.
    name String
    Unique name for the federated provider. Changing it creates a new provider.
    password String
    Password for the remote service account. State stores its SHA-256 hash. Creation and configured password changes send the original password to Splunk; password changes update the provider in place without replacement. Other updates omit the password. Splunk does not return this secret, so changes made directly in Splunk cannot be detected.
    serviceAccount String
    Username of the service account on the remote deployment.
    appContext string
    App on the remote search head used by standard-mode searches. Defaults to search; transparent mode ignores this value.
    hostPort string
    Remote Splunk management host and port, such as remote-splunk:8089.
    mode string
    Federated search mode: standard (default) or transparent. A local deployment must not mix provider modes.
    name string
    Unique name for the federated provider. Changing it creates a new provider.
    password string
    Password for the remote service account. State stores its SHA-256 hash. Creation and configured password changes send the original password to Splunk; password changes update the provider in place without replacement. Other updates omit the password. Splunk does not return this secret, so changes made directly in Splunk cannot be detected.
    serviceAccount string
    Username of the service account on the remote deployment.
    app_context str
    App on the remote search head used by standard-mode searches. Defaults to search; transparent mode ignores this value.
    host_port str
    Remote Splunk management host and port, such as remote-splunk:8089.
    mode str
    Federated search mode: standard (default) or transparent. A local deployment must not mix provider modes.
    name str
    Unique name for the federated provider. Changing it creates a new provider.
    password str
    Password for the remote service account. State stores its SHA-256 hash. Creation and configured password changes send the original password to Splunk; password changes update the provider in place without replacement. Other updates omit the password. Splunk does not return this secret, so changes made directly in Splunk cannot be detected.
    service_account str
    Username of the service account on the remote deployment.
    appContext String
    App on the remote search head used by standard-mode searches. Defaults to search; transparent mode ignores this value.
    hostPort String
    Remote Splunk management host and port, such as remote-splunk:8089.
    mode String
    Federated search mode: standard (default) or transparent. A local deployment must not mix provider modes.
    name String
    Unique name for the federated provider. Changing it creates a new provider.
    password String
    Password for the remote service account. State stores its SHA-256 hash. Creation and configured password changes send the original password to Splunk; password changes update the provider in place without replacement. Other updates omit the password. Splunk does not return this secret, so changes made directly in Splunk cannot be detected.
    serviceAccount String
    Username of the service account on the remote deployment.

    Import

    Import using the provider name:

    $ pulumi import splunk:index/federatedProviders:FederatedProviders remote remote-splunk

    After import, set password in configuration before updating the resource.

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Splunk pulumi/pulumi-splunk
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the splunk Terraform Provider.
    splunk logo splunk logo
    Viewing docs for Splunk v1.4.4
    published on Wednesday, Sep 23, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-splunk

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial