Splunk Connection

Connects your agent to Splunk Enterprise or Splunk Cloud for log analysis and SIEM operations. Run SPL queries, retrieve notable events, manage saved searches, and pull alert data.

Authentication

Bearer token (Splunk auth token). Generate from Settings > Tokens in Splunk Web.

• token — Splunk authentication token
• base_url — Your Splunk instance URL (e.g., https://splunk.company.com:8089)

For Splunk Cloud, use the API endpoint from your cloud stack admin panel.

Endpoints

Search

• POST /services/search/jobs — Create a new search job (SPL query)
• GET /services/search/jobs/{sid} — Check search job status
• GET /services/search/jobs/{sid}/results — Get search results (JSON)
• DELETE /services/search/jobs/{sid} — Cancel a running search

Saved Searches

• GET /services/saved/searches — List saved searches
• POST /services/saved/searches/{name}/dispatch — Run a saved search
• GET /services/saved/searches/{name}/history — Get run history

Notable Events (ES)

• GET /services/notable_events — Search notable events with filters
• POST /services/notable_update — Update notable event status (requires confirmation)

Alerts

• GET /services/alerts/fired_alerts — List fired alerts
• GET /services/alerts/fired_alerts/{name} — Get alert detail

Indexes

• GET /services/data/indexes — List available indexes
• GET /services/data/indexes/{name} — Get index detail and data summary

Rules

• Search jobs have a 5-minute timeout by default — configurable per query
• Notable event status updates are logged to audit trail
• Rate limit: 20 concurrent search jobs, 200 requests/minute
• The agent uses | head 1000 on unbounded searches to prevent context overflow
• Queries spanning >7 days automatically use summary indexes when available