diff --git a/applications/itd/splunk/module.nix b/applications/itd/splunk/module.nix
new file mode 100644
index 0000000..e186929
--- /dev/null
+++ b/applications/itd/splunk/module.nix
@@ -0,0 +1,165 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+with lib; let
+  name = "splunk";
+  cfg = config.services.itd."${name}";
+
+  package = pkgs.callPackage ./package.nix {};
+in {
+  imports = [];
+
+  options.services.itd."${name}" = {
+    enable = mkEnableOption "ITD Splunk";
+
+    user = {
+      user = mkOption {
+        type = types.str;
+        default = "splunk";
+      };
+      group = mkOption {
+        type = types.str;
+        default = "splunk";
+      };
+
+      home = mkOption {
+        type = types.str;
+        default = "/etc/itd/splunk";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # create user and group for the program
+    users.groups."${cfg.user.group}" = {};
+    users.users."${cfg.user.user}" = {
+      createHome = true;
+      isNormalUser = true;
+      home = cfg.user.home;
+      group = cfg.user.group;
+      # X11 is to ensure the directory can be traversed
+      homeMode = "711";
+    };
+
+    # might not be required
+    #    networking.firewall.allowedTCPPorts = [8089];
+
+    # set up the core files
+    systemd.services."${name}_prestart" = {
+      wantedBy = [
+        #      "gitlab.target"
+      ];
+      partOf = [
+        #      "gitlab.target"
+      ];
+      path = with pkgs; [util-linux];
+      serviceConfig = {
+        Type = "oneshot";
+        User = "root";
+        Group = "root";
+        #        User = cfg.user.user;
+        #        Group = cfg.user.group;
+        #        TimeoutSec = "infinity";
+        #        Restart = "on-failure";
+        #        WorkingDirectory = "${cfg.package}/share/gitlab";
+        #        Slice = "system-gitlab.slice";
+        RemainAfterExit = true;
+        ExecStart = let
+          # from $SPLUNK_HOME/etc/splunk-launch.conf.default
+          splunk_launch = pkgs.writeText "splunk-launch" ''
+            SPLUNK_HOME=${cfg.user.home}
+            SPLUNK_SERVER_NAME=SplunkForwarder
+            PYTHONHTTPSVERIFY=0
+            PYTHONUTF8=1
+          '';
+
+          etc_passwd = pkgs.writeText "passwd" ''
+            :admin:$6$XOFhpq0Y1Ul1pejO$DUkXU6xSAKYrl3nLTPFS7LJqlnWC4r97SSikjCzv7XNEG6lgP32TZHyLDY/aJs8ZYyblZ5spfmnlMvh8Lxndi/::Administrator:admin:changeme@example.com:::20329
+          '';
+
+          deployment_client = pkgs.writeText "deploymentclient" ''
+            [deployment-client]
+            clientName = UL_client
+            [target-broker:deploymentServer]
+            targetUri = soc-deployment.heanet.ie:8089
+          '';
+        in
+          pkgs.writeShellScript "splunk-config" ''
+            set -o errexit -o pipefail -o nounset
+            shopt -s inherit_errexit
+
+            umask u=rwx,g=rx,o=
+
+            # start with a clean slate, it yells at ye if ye try to boot it up without doing this
+            rm -rf ${cfg.user.home}/*
+
+            chmod 771 -R ${cfg.user.home}
+
+            # pull in all relevent files
+            cp -f -R ${package}/* ${cfg.user.home}
+
+            chmod 771 -R ${cfg.user.home}
+            chown ${cfg.user.user}:${cfg.user.group} -R ${cfg.user.home}
+
+            # if [ ! -f ${cfg.user.home}/etc/splunk-launch.conf ]; then
+              export SPLUNK_HOME=${cfg.user.home}
+
+              cp ${splunk_launch} $SPLUNK_HOME/etc/splunk-launch.conf
+
+              cp ${etc_passwd} $SPLUNK_HOME/etc/passwd
+
+              # ensure the dir exists
+              mkdir -p $SPLUNK_HOME/etc/apps/000_ul_umbrio_essentials/local/
+              cp ${deployment_client} $SPLUNK_HOME/etc/apps/000_ul_umbrio_essentials/local/deploymentclient.conf
+
+
+              # Splunk is doing a crime by deciding what teh path is, need to comment out this line
+              # in /bin/pid_check.sh
+              # PATH=/usr/xpg4/bin:/usr/bin:/bin
+              # PATH=
+              sed -i -e 's/PATH=/#PATH=/g' ${cfg.user.home}/bin/pid_check.sh
+
+              # make sure user permissions are correct
+              chmod 771 -R ${cfg.user.home}
+              chown ${cfg.user.user}:${cfg.user.group} -R ${cfg.user.home}
+
+              # run it to see if that works
+              runuser -u ${cfg.user.user} -- $SPLUNK_HOME/bin/splunk start --accept-license
+
+              # $SPLUNK_HOME/bin/splunk enable boot-start
+              # /etc/systemd/system/multi-user.target.wants/SplunkForwarder.service
+            # fi
+          '';
+      };
+    };
+
+    systemd.services."${name}" = {
+      wantedBy = [
+      ];
+      requires = [
+        "${name}_prestart.service"
+      ];
+      path = with pkgs; [util-linux toybox];
+      serviceConfig = {
+        Type = "oneshot";
+        User = cfg.user.user;
+        Group = cfg.user.group;
+        TimeoutSec = "infinity";
+        Restart = "on-failure";
+        #        WorkingDirectory = "${cfg.package}/share/gitlab";
+        #        Slice = "system-gitlab.slice";
+        RemainAfterExit = true;
+
+        Environment = "SPLUNK_HOME=${cfg.user.home}";
+        ExecStart = "${package}/bin/splunk  _internal_launch_under_systemd";
+
+        # no so sure about these
+        NoNewPrivileges = "yes";
+        AmbientCapabilities = "CAP_DAC_READ_SEARCH";
+      };
+    };
+  };
+}