Splunk integration

Visualize the topology and telemetry data with a dependency map instead of a plane table view. All available data in Splunk about business services, processes and supporting infrastructure components are automatically synchronized in this map.

Send Splunk data to StackState

StackState synchronizes all your tools and technologies in one place. This information is processed into our StackState model, which is built on a versioned graph database. The information is visualized and ready to be analyzed. StackState retrieves the following information from Splunk:


Auto-detect components and their dependencies to create a single pane of glass.


Collect relevant metrics


Proactively detect incidents and correlate events across your monitoring ecosystem.

Use cases

Synchronize your data lake and retrieve topology- and telemetry information from Splunk into StackState. This information is processed into our real-time model, which is built on a versioned graph database. The information is visualized and ready to be analyzed. Instead of the need to write very large queries (> 100 lines) in Splunk, StackState allows you to create very simple queries (< 10 lines). It only selects and formats the necessary data, since correlation and aggregation are done by the StackState model.

Business impact analysis

Understand which components or business services are impacted when underlying supporting components go to maintenance, are replaced or experience an issue. By understanding the possible impact and applying anomaly detection technology, outages and/or slowdowns can even be prevented.

Compliancy checks

StackState helps you to ensure your IT components comply to certain standards and requirements. By retrieving, correlating and aggregating all available data in your enterprise, StackState is able to perform advanced analytics on the data, stored in our versioned graph database. Some examples are:

  • Show all components that are not compatible with other components according to a support matrix.
  • Show all components that are not redundant.
  • Show all components that are not used by an end user anymore, for a specific period of time.
Proactive decommissioning and cost optimization

Do you know which components in your environment are consuming power and licenses being paid for, while they are under-utilized or even worse, don’t contribute to the business or your customers at all? Because of the capability to apply analytics over components, their relations and all other information (telemetry-, change-, software inventory- and licensing data), StackState can identify candidates for proactive decommissioning:

  • Show all components that are not related to a business- or end user service
  • Show all components that are in an inactive state for a specific period of time
  • Show costs (e.g. licensing, maintenance, energy consumption) associates with these components
Time traveling

We capture the state changes of all major and minor changes over time. All the versions are stored in StackState’s versioned graph database. It is designed to provide time traveling capabilities. You can get insight into the current state of your landscape and be able to travel back in time to discover what and when something has changed and how does this relate to incidents.

Further research

Still have questions? Here are a few useful resources for you to dig a little deeper.


Check out our documentation for detailed help on setting up Splunk in StackState. Learn more.

Data sheet

Read more on the benefits of using StackState and Splunk together. Download now.


Questions about this integration? Suggestions? We want to hear from you.

Bring everything in one place

Add value to the tools you already love

View 80+ integrations