Splunk - Delete Assets

Splunk - Delete Assets deletes Splunk assets that are no longer valid or active in Axonius for:

• Assets returned by the selected query or assets selected on the relevant asset page.

Required Fields

• Use stored credentials from Splunk adapter - Select this option to choose which Splunk connected adapter credentials to use.

  • When you select this option, the Select Adapter Connection drop-down becomes available. Select the adapter connection to use for this Enforcement Action.

  📘

  Note

  To use this option, you must successfully configure a Splunk adapter connection.

• KVStore Collection Name - The name of the KV store collection from which to delete the assets.

• Compute Node - The Axonius node to use when connecting to the specified host. For more details, see Working with Axonius Compute Nodes.

Additional Fields

These fields are optional.

💡

Connection and Credentials

When Use stored credentials from the adapter is toggled off, some of the connection fields below are required to create the connection, while other fields are optional.

• Host Name - The hostname of the Splunk search head.

• Port - Specify the port of the Splunk system. It is recommended to use TCP port 8089. For more details, see Splunk Docs - Securing Splunk Enterprise.

• Protocol (rdefault: HTTPS) - Select between HTTP and HTTPS protocols when using that specific adapter connection.

• User Name and Password - The user name and password for an account that has read access to the API.

📘

Note

If API Token is not supplied, the above fields are required.

• API Token - API token can be used instead of user name and password.

📘

Note

If User Name and Password are not supplied, the above field is required.

• Exclude connections - Assets from the selected connections will not be included in the query results. You can select more than one.

APIs

Axonius uses the Splunk API.

Required Permissions

• Permission to delete assets.