--- title: Configuring Ivanti Access Splunk application slug: access-guide/configuring-ivanti-access-splunk-application docTags: createdAt: 2026-10-09T06:41:08.063Z --- Splunk fetches Audit logs and Ivanti Access reports for a tenant everyday from Ivanti Access. You must configure Ivanti Access Splunk application for this activity. Splunk v8.0.1 and Ivanti Access Splunk app v5.0 is now supported. **Prerequisites ** • Verify that you have installed Java 8 (JRE and JDK). • Verify that before you upgrade, delete the configured data input for Ivanti Access if any. **Procedure ** 1. Copy the app distribution .spl file (miaccess\_splunk\_ap.spl) to the Splunk machine. The **.spl file** is available at [Product Documentation Page.](https://forums.ivanti.com/s/article/Splunk-App-for-MobileIron-Access-logging-and-reporting-7474) 2. Login to **Splunk** > **Apps**. 3. Click **Install app from file **and select **miaccess\_splunk\_app.spl** file. The **Upload an app** window opens. ::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/dTEKn6tM9yTBhTpcmD01-_splunkinstall.png" position="flex-start" size="100" width="1229" height="448" initialPath="../Resources/Images/SplunkInstall.png" githubPath="Resources/Images/SplunkInstall.png" darkWidth="1229" darkHeight="448" showCaption="false" indent="1"} ::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/l-MkB02bwehR0xBFE4k0R_splunkuploadr20.png" position="flex-start" size="100" width="1067" height="399" initialPath="../Resources/Images/SplunkUploadR20.png" githubPath="Resources/Images/SplunkUploadR20.png" darkWidth="1067" darkHeight="399" showCaption="false" indent="1"} 4. Click **Choose file** and select **miaccess\_splunk\_app.spl**. 5. Select **Upgrade app. Check this will overwrite the app if it already exists**. :::Paragraph{indent="1"} If you do not have the miaccess-splunk app already installed, then deselect this box. ::: 6. Click **Upload**. :::Paragraph{indent="1"} Once the upload completes, configure the data inputs. ::: 7. Click **Settings** > **Data inputs**. ::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/fNOqvpdbLiAmmNbvt5roY_splunkdatainputsr20.png" size="81" isUploading="false" initialPath="../Resources/Images/SplunkDataInputsR20.png" githubPath="Resources/Images/SplunkDataInputsR20.png" width="812" height="233" darkWidth="812" darkHeight="233" showCaption="false"} :::Paragraph{indent="1"} The miaccess\_splunk\_app entry is now listed in local **Data inputs**. ::: ::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/FGloe_xFtg2vyu1Ur7zZv_splunkdatainputr28.png" position="flex-start" size="100" width="811" height="166" initialPath="../Resources/Images/SplunkDataInputR28.png" githubPath="Resources/Images/SplunkDataInputR28.png" darkWidth="811" darkHeight="166" showCaption="false" indent="1"} :::hint{type="info" indent="1"} If you do not see the app listed in local Data inputs, then restart Splunk. ::: 7. Click **New** in miaccess\_splunk\_app to configure the file. :::Paragraph{indent="1"} The data input screen appears. ::: 8. Enter the following details: :::Paragraph{indent="1"} Do not modify the data inputs when the job is running. However, you can modify the data inputs when the job is not running. ::: :::Paragraph{listStyleType="disc" indent="2"} **Ivanti Access Splunk app Configuration**: Enter any name for the input configuration. ::: :::Paragraph{listStyleType="disc" indent="2"} **Ivanti Access Read-only admin username** and **Ivanti Access Read-only admin password**: Enter the Ivanti Access username and password. ::: 9. Use Ivanti Access read-only user. - **Ivanti Access admin url**: Enter the Ivanti Access admin URL such as https\://access-na1.ivanti.com or https\://access-eu1.ivanti.com. - Ivanti Access Read-only admin username: Enter the Ivanti Access username. - Ivanti Access Read-only admin password: Enter the password for Ivanti Access. The password is now masked. - **Splunk user role username**: Enter the Splunk username with minimum user having *edit\_tcp* role. - **Splunk user role password**: Enter the Splunk user role password. - Splunk management port: Enter the management port such as 8089. - **Polling interval in hours**: Enter the frequency in number of hours to pull data from Ivanti Access. 10. Click **Save**. You can now monitor the fetching of audit logs and access reports in **splunkd.log** file. Use the following indexes to search for the reports after the Ivanti Access Reports are available in Splunk: - index="miaccess\_report\_index” - index="miaccess\_audit\_log\_index" • After importing the .spl file, if the app is not visible, then restart Splunk. - When you configure Splunk for the first time, it pulls data for past 90 days which can take a few minutes. ## Splunk dashboard After adding and configuring the .spl file, the Ivanti Access application is available on the homepage. Click the application to view the dashboards for the application. Figure: Splunk dashboard ![](https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/BJyhZvMW8yZgZrjp0_x7u_splunkappdashboardr20.png) The graphs are prepopulated for AuditLogs and Ivanti AccessReports. There is one graph for AuditLogs and four graphs for Ivanti Access Reports. Figure: Audit Logs ![](https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/hGKr0IpGdUTLCB2smAbSI_splunkdashboardauditr20.png) Figure: Ivanti Access Reports Platforms ![](https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/_Ek-WTdoPM00J4tJSHJhe_splunkdashboardreportr20.png) Figure: Ivanti AccessReports Actions ![](https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/FR1tpBVQ4LqWS1Uazx2M0_splunkdashboardreport1r20.png) Figure: Ivanti Access reports Geodata ![](https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/AUdL3OfQ1iRilnqKnSerC_splunkaccessgeodata.png) Figure: Ivanti Access reports Country name ![](https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/LNjZF44I_8LHqXt1etr23_splunkgeodatacountry.png) Figure: Ivanti Access reports derived useragents ![](https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/6Y8aay2hTYzQHzf58jOuv_splunkderiveduseragent.png)