Overview
Splunk is the leading log + event analytics platform. The Automize Splunk connector covers search, alerts, dashboards, saved searches, data input.
- Regions: Splunk Cloud (multi-region) or Splunk Enterprise (self-hosted).
- Plans: By data volume + GB ingest/day.
Setting up the connection
Auth type: Bearer Token.
- Splunk admin → User → Token.
- In Automize → Settings → Connectors → Splunk. Paste token + Splunk URL.
Find your credentials at https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTaccess.
Rate limits
Per-deployment capacity.
Data model
Splunk primitives:
Index ─── Events (timestamped logs)
Search Job ─── Results
Alert + Saved Search
DashboardAvailable operations
21 operations available. Click any row to jump to its detail.
| Operation | Category | What it does |
|---|---|---|
| Create Index | General | Create a new index |
| Create Saved Search | General | Create a new saved search |
| Dispatch Saved Search | General | Run a saved search |
| Get Dashboard | General | Get a dashboard by name |
| Get Index | General | Get index details |
| Get KV Store Data | General | Get data from a KV store collection |
| Get Saved Search | General | Get a saved search by name |
| Get Search Results | General | Get results of a search job |
| Get Search Status | General | Get status of a search job |
| Get Server Info | General | Get server information |
| Insert KV Store Data | General | Insert data into a KV store collection |
| List Alerts | General | List fired alerts |
| List Apps | General | List installed apps |
| List Dashboards | General | List all dashboards |
| List Indexes | General | List all indexes |
| List Inputs | General | List all data inputs |
| List KV Store Collections | General | List KV store collections |
| List Saved Searches | General | List all saved searches |
| Oneshot Search | General | Run a oneshot search that returns results immediately |
| Search | General | Create a search job |
| Submit Event | General | Send raw event data to an index |
Operations
Create Index
Create a new index
No input parameters.
Create Saved Search
Create a new saved search
No input parameters.
Dispatch Saved Search
Run a saved search
| Parameter | Required | Type | Description |
|---|---|---|---|
Name name | Yes | text |
Get Dashboard
Get a dashboard by name
| Parameter | Required | Type | Description |
|---|---|---|---|
Name name | Yes | text |
Get Index
Get index details
| Parameter | Required | Type | Description |
|---|---|---|---|
Name name | Yes | text |
Get KV Store Data
Get data from a KV store collection
| Parameter | Required | Type | Description |
|---|---|---|---|
Collection collection | Yes | text |
Get Saved Search
Get a saved search by name
| Parameter | Required | Type | Description |
|---|---|---|---|
Name name | Yes | text |
Get Search Results
Get results of a search job
| Parameter | Required | Type | Description |
|---|---|---|---|
Search Id search_id | Yes | text |
Tips
- Poll job ID. Returns rows.
Get Search Status
Get status of a search job
| Parameter | Required | Type | Description |
|---|---|---|---|
Search Id search_id | Yes | text |
Get Server Info
Get server information
No input parameters.
Insert KV Store Data
Insert data into a KV store collection
| Parameter | Required | Type | Description |
|---|---|---|---|
Collection collection | Yes | text |
List Alerts
List fired alerts
No input parameters.
Tips
- Active alerts + their schedules.
List Apps
List installed apps
No input parameters.
List Dashboards
List all dashboards
No input parameters.
Tips
- User + app-scoped dashboards.
List Indexes
List all indexes
No input parameters.
List Inputs
List all data inputs
No input parameters.
List KV Store Collections
List KV store collections
No input parameters.
List Saved Searches
List all saved searches
No input parameters.
Oneshot Search
Run a oneshot search that returns results immediately
| Parameter | Required | Type | Description |
|---|---|---|---|
Search search | No | text | |
Earliest Time earliest_time | No | text | |
Latest Time latest_time | No | text | |
Output Mode output_mode | No | text |
Search
Create a search job
| Parameter | Required | Type | Description |
|---|---|---|---|
Search search | No | text | |
Earliest Time earliest_time | No | text | |
Latest Time latest_time | No | text | |
Output Mode output_mode | No | text |
Submit Event
Send raw event data to an index
No input parameters.
FAQ
- SPL?
- Splunk Processing Language – Splunk's powerful query language. 'index=main sourcetype=access | stats count by status'.