Make REST API calls with Authentication Tokens in Splunk Cloud

Available Languages

Updated:September 29, 2026
Document ID:SPLK048878

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud

Description

It might be confusing to create REST API Calls with tokens considering format is different than working with username and password. This article includes important required steps in order to troubleshoot issues while making REST API calls with tokens.

Investigation

First make sure you followed the respective steps and meet requirements in order to configure authentication tokens either with SAML or Splunk native authentication
SAML Config JWT
Setup authentication with tokens

After this, you might be experiencing connection issues such as:

curl: (7) Failed connect to stack.splunkcloud.com:8089; Connection timed out

OR, after meeting all the requirements you might receive the following format output preventing you from create searches via REST API:

<?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="ERROR">Unauthorized</msg>
</messages>
</response>

Resolution

1- Create the Token:

  • Navigate to Settings > Tokens > New Token
  • Add the Audience and Expiration Date, then click on Create
  • Copy the token 

2- For connection issues you can proceed to check Splunk Cloud allow list by going to Settings > Server Settings > IP allow list and add respective IPs to it
Configure IP AllowList

3- When experiencing format issues such as unauthorized message included above, make sure to use the following query format:

curl -H "Authorization: Bearer TOKEN" -X POST https://<host>.splunkcloud.com:8089/services/search/jobs -d search="search error earliest=-7d"

The search must be adjusted based on the TOKEN, endpoint and search.

A Sid will be received, which is a search ID. With this you can retrieve the results as csv, json, XML. The command should look like:

curl -H "Authorization: Bearer <token>" --get https://<host>.splunkcloud.com:8089/services/search/job/<sid>/result" -d output_mode=json

Use the same logic to check for status of a search before retrieving it by using the reference below:

Check status of a search
REST searches


How retrieve search results via Splunk API

Use Auth Tokens

REST searches

Configure IP AllowList

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products