ROVIX Universal API Add-on for Splunk

ROVIX Universal API Add-on for Splunk lets you bring data from any REST/JSON API into Splunk by filling in forms. No code or custom scripts are needed. The problem it solves Security and IT teams need data from dozens of cloud services: identity providers, EDR tools, SaaS platforms, threat-intelligence feeds and internal APIs. Many of these have no Splunk add-on, or the add-on is outdated or limited. The usual workarounds are custom Python scripts or one-off modular inputs. Each one handles OAuth tokens, pagination and “what did I already collect?” differently, breaks when a token expires, and is hard to maintain or hand over. What the add-on does One place for every API. Define an account (credentials and authentication) once, then create as many inputs as you need. Each input has its own endpoint, interval, index and sourcetype. Handles authentication for you. Supports OAuth 2.0 (client credentials, authorization code with automatic refresh-token rotation, password grant), JWT bearer and private_key_jwt (including Google service accounts), session login, HMAC request signing, API key, bearer token, Basic and Digest, plus mTLS. Tokens are stored encrypted in Splunk, refreshed before they expire, and renewed automatically if the API rejects them. Collects everything, exactly once. Built-in pagination (offset, page, cursor, Link header, next URL) fetches every page. Checkpoints in the KV Store pick up where the last run stopped, and only move forward after a run completes successfully, so data isn’t skipped. Built to keep running. Retries with back-off on rate limits (HTTP 429) and server errors, honouring Retry-After. A monitoring dashboard and per-input logs make problems easy to see. Who it’s for: Splunk admins and SOC teams who need to onboard API-based data sources quickly and reliably on Splunk Enterprise or Splunk Cloud Platform, without writing and maintaining code. Licensing: a 30-day free evaluation with all features is included, then a per-server license key, verified offline. The add-on runs entirely inside your Splunk environment and sends no data to Rovix Technologies. Developed by Rovix Technologies Pvt. Ltd. Contact: info@RovixTechnologies.com