icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.
Log4Shell Vulnerability: Information and guidance for you. Get resources.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading PureStorage Unified Add-on for Splunk
SHA256 checksum (purestorage-unified-add-on-for-splunk_120.tgz) c50ad63c9dab3ea0698c6a250aa3df25e593451312124f777fa26835aeb2afb4 SHA256 checksum (purestorage-unified-add-on-for-splunk_110.tgz) c0d8507f1617f562b73fa354ee7b70d555c0025dadc7be32883707e327917c8d SHA256 checksum (purestorage-unified-add-on-for-splunk_100.tgz) 4972af00b78328a7be333c2b8de4ddc40c7574ae26bf5b7b3ad2eb20af76d8a6
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate


PureStorage Unified Add-on for Splunk

Splunk Cloud
The PureStorage Unified Add-on is used to collect logs, alerts, audits, and metrics from PureStorage FlashBlade and FlashArray or from Pure1 into your Splunk environment.

* Supports FlashBlade REST API 1.0 to 1.11 (except 1.10)
* Supports FlashArray REST API 1.13 to 1.18 (FA/Purity Version 5.0.0 and above)

* Splunk version 7.3.x or 8.0.x or 8.1.x or 8.2.x
* Appropriate API Token for collecting data from FlashBlade and FlashArray or JWT token for Pure1.
* Supports only secured connection between Splunk and the arrays.

Please check out the README.md that is included with this package or the following article for configuring this add-on as well as handling self-signed certificates.


Please see the Details tab in this page for more details if you are upgrading from v1.0.0 to v1.1.0.


Upgrading the Add-on to v1.1.0 from 1.0.0

  • If you want to disable SSL certificate validation, then follow the below steps:
    • Navigate to path: $SPLUNK_HOME/etc/apps/TA-purestorage-unified/local/. If folder local is not present at the location: $SPLUNK_HOME/etc/apps/TA-purestorage-unified/, create folder named local at the location.
    • Check for file: ta_purestorage_unified_settings.conf at location: $SPLUNK_HOME/TA-purestorage-unified/local/. If the file is not present, create the file ta_purestorage_unified_settings.conf at the location.
    • In file $SPLUNK_HOME/etc/apps/TA-purestorage-unified/local/ta_purestorage_unified_settings.conf add stanza purestorage_additional_parameters at the end of the file and set the value of verify_ssl variable to False as done below :
      [purestorage_additional_parameters] verify_ssl = False
    • Restart Splunk


After installation:

  • Navigate to PureStorage Unified TA, click on "Configuration" page, go to "System" tab and then click "Add", choose "System Type", fill in "System Name", "Server Address" (without the https scheme) and "Authentication/JWT Token" then click the "Add" button.
    • If "System Type" is FlashBlade/FlashArray, provide API Token in the "Authentication/JWT Token" field.
    • If "System Type" is Pure1, provide JWT Token in the "Authentication/JWT Token" field.


      • Please follow from the section "Create Key Pair" section in the following documentation to generate the JWT token for the Pure1 system: https://blog.purestorage.com/products/introducing-the-pure1-rest-api/. You need to provide the JWT token (not Access token) while configuring a Pure1 system in Splunk.
      • To get the API token, use the below CLI command that can be issued against FlashArray or FlashBlade.
        pureadmin list --api-token --expose
      • For System Type Pure1, only one input can be configured corresponding to one Pure1 System. Trying to configure multiple inputs with same Pure1 System is not allowed.


  • If you have already configured a FlashBlade or FlashArray Input, then configuring a Pure1 input associated with the same FlashBlade and FlashArray or vice versa would lead to duplicate data/events in Splunk and will increase Splunk data volume and license usage.
  • The data for Pure1 > metrics/history endpoint will be collected for end_time as current_time - 1hr, because the data is updated with delay in Pure1 API, and Splunk data collection is completed before the delayed update is made available.
  • If the Start Date configured by the user is greater than current_time - 1hr, data for the metrics/history endpoint will not be collected.

Release Notes

Version 1.2.0
March 7, 2022

Added support for mirrored write metric for FlashArray

Version 1.1.0
Nov. 12, 2021
  • Version - 1.1.0
    • Provided support of Pure1.
    • Added support for Batch configuration of Systems and Inputs.
Version 1.0.0
April 29, 2021

Initial release 1.0.0

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.