Splunk

Reference for the Tracecat Splunk integration: registered actions, required secrets, expected inputs, and example workflow usage.

Add fields to collection

Action ID: tools.splunk.add_kv_fields

Add field definitions to a KV Store collection in Splunk.

Reference: https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#post-9

Secrets

Required secrets:

• splunk: required values SPLUNK_API_KEY.

Input fields

collection · string · required

Name of the KV Store collection to add fields to. Must be unique and contain only alphanumeric characters, underscores, and hyphens.

fields · array[map[string, string]] · required

List of field definitions to add. Each field requires name and type. Supported types: array, number, bool, string, cidr, time Example: [{“name”: “username”, “type”: “string”}, {“name”: “age”, “type”: “number”}]

app · string

Splunk app context where the collection resides (e.g. “search” for default).

Default: "search".

base_url · string | null

Splunk base URL (e.g. https://localhost:8089 or https://tracecat.splunkcloud.com:8089).

Default: null.

owner · string

Splunk namespace owner for access control (use “nobody” for shared access).

Default: "nobody".

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Batch save KV entries

Action ID: tools.splunk.batch_save_kv_entries

Insert or update multiple entries in a Splunk KV Store collection in a single request. If an entry includes a _key that matches an existing document, it is updated; otherwise a new document is created. Processing stops on the first failure.

Reference: https://help.splunk.com/en/splunk-cloud-platform/leverage-rest-apis/rest-api-reference/10.0.2503/kv-store-endpoints/kv-store-endpoint-descriptions#ariaid-title16

Secrets

Required secrets:

• splunk: required values SPLUNK_API_KEY.

Input fields

collection · string · required

Name of the KV Store collection to save entries into.

entries · array[object] · required

List of documents to save. Each document is a dict of field-value pairs. Include a _key field to update an existing document; omit it to create a new one (Splunk auto-generates the key). Maximum 1000 documents per request (Splunk default). Example: [{“username”: “john”, “email”: “[e-mail]”, “active”: true}, {“username”: “jane”, “email”: “[e-mail]”, “active”: false}]

app · string

Splunk app context where the collection resides (e.g. “search” for default).

Default: "search".

base_url · string | null

Splunk base URL (e.g. https://localhost:8089 or https://tracecat.splunkcloud.com:8089).

Default: null.

owner · string

Splunk namespace owner for access control (use “nobody” for shared access).

Default: "nobody".

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Create KV collection

Action ID: tools.splunk.create_kv_collection

Create a new KV Store collection in Splunk.

Reference: https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#post-9

Secrets

Required secrets:

• splunk: required values SPLUNK_API_KEY.

Input fields

name · string · required

Name of the KV Store collection. Must be unique and contain only alphanumeric characters, underscores, and hyphens.

app · string

Splunk app context where the collection will be created (e.g. “search” for default).

Default: "search".

base_url · string | null

Splunk base URL (e.g. https://localhost:8089 or https://tracecat.splunkcloud.com:8089).

Default: null.

owner · string

Splunk namespace owner for access control (use “nobody” for shared access).

Default: "nobody".

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Create KV entry

Action ID: tools.splunk.create_kv_entry

Create a new entry in a Splunk KV Store collection.

Reference: https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#post-2

Secrets

Required secrets:

• splunk: required values SPLUNK_API_KEY.

Input fields

collection · string · required

Name of the KV Store collection where the entry will be created.

entry · object · required

Key-value pairs to store in the collection. The _key field is automatically generated by Splunk if not provided. Example: {“username”: “john”, “email”: “[e-mail]”, “active”: true}

app · string

Splunk app context where the collection resides (e.g. “search” for default).

Default: "search".

base_url · string | null

Splunk base URL (e.g. https://localhost:8089 or https://tracecat.splunkcloud.com:8089).

Default: null.

owner · string

Splunk namespace owner for access control (use “nobody” for shared access).

Default: "nobody".

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Delete KV collection

Action ID: tools.splunk.delete_kv_collection

Delete a KV Store collection from Splunk.

Reference: https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#delete-0

Secrets

Required secrets:

• splunk: required values SPLUNK_API_KEY.

Input fields

collection · string · required

Name of the KV Store collection to delete.

app · string

Splunk app context where the collection resides (e.g. “search” for default).

Default: "search".

base_url · string | null

Splunk base URL (e.g. https://localhost:8089 or https://tracecat.splunkcloud.com:8089).

Default: null.

owner · string

Splunk namespace owner for access control (use “nobody” for shared access).

Default: "nobody".

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Delete KV entry

Action ID: tools.splunk.delete_kv_entry

Delete an entry from a KV Store collection in Splunk.

Reference: https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#delete-1

Secrets

Required secrets:

• splunk: required values SPLUNK_API_KEY.

Input fields

collection · string · required

Name of the KV Store collection containing the entry.

entry_key · string · required

The _key value of the entry to delete from the collection. Example: “5f3a1b2c3d4e5f6a7b8c9d0e”

app · string

Splunk app context where the collection resides (e.g. “search” for default).

Default: "search".

base_url · string | null

Splunk base URL (e.g. https://localhost:8089 or https://tracecat.splunkcloud.com:8089).

Default: null.

owner · string

Splunk namespace owner for access control (use “nobody” for shared access).

Default: "nobody".

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Discover fields

Action ID: tools.splunk.discover_fields

Discover fields in Splunk data using the fieldsummary command with statistics and sample values.

Reference: https://help.splunk.com/en?resourceId=Splunk_SearchReference_Fieldsummary&version=splunk-9_4

Secrets

Required secrets:

• splunk: required values SPLUNK_API_KEY.

Input fields

end_time · string · required

End time for the search.

start_time · string · required

Start time for the search.

adhoc_search_level · string

Adhoc search level.

Default: "fast".

base_url · string | null

Splunk base URL (e.g. https://localhost:8089).

Default: null.

index · string

Index to search for fields. Use * for all indexes.

Default: "*".

limit · integer

Maximum number of fields to return.

Default: 100.

max_values · integer

Maximum number of sample values to return per field.

Default: 5.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Get KV collection

Action ID: tools.splunk.get_kv_collection

Get configuration details for a specific KV Store collection from Splunk.

Reference: https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#get-5

Secrets

Required secrets:

• splunk: required values SPLUNK_API_KEY.

Input fields

collection · string · required

Name of the KV Store collection to retrieve.

app · string

Splunk app context where the collection resides (e.g. “search” for default).

Default: "search".

base_url · string | null

Splunk base URL (e.g. https://localhost:8089 or https://tracecat.splunkcloud.com:8089).

Default: null.

owner · string

Splunk namespace owner for access control (use “nobody” for shared access).

Default: "nobody".

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Get KV entry

Action ID: tools.splunk.get_kv_entry

Get a specific entry from a KV Store collection in Splunk.

Reference: https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#get-7

Secrets

Required secrets:

• splunk: required values SPLUNK_API_KEY.

Input fields

collection · string · required

Name of the KV Store collection containing the entry.

entry_key · string · required

The _key value of the entry to retrieve from the collection. Example: “5f3a1b2c3d4e5f6a7b8c9d0e”

app · string

Splunk app context where the collection resides (e.g. “search” for default).

Default: "search".

base_url · string | null

Splunk base URL (e.g. https://localhost:8089 or https://tracecat.splunkcloud.com:8089).

Default: null.

owner · string

Splunk namespace owner for access control (use “nobody” for shared access).

Default: "nobody".

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

List data models

Action ID: tools.splunk.list_data_models

List all data models on the Splunk server using native Splunk search.

Secrets

Required secrets:

• splunk: required values SPLUNK_API_KEY.

Input fields

adhoc_search_level · string

Adhoc search level.

Default: "fast".

base_url · string | null

Splunk base URL (e.g. https://localhost:8089).

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

List field extractions

Action ID: tools.splunk.list_field_extractions

List all configured field extraction rules using a simple Splunk query.

Secrets

Required secrets:

• splunk: required values SPLUNK_API_KEY.

Input fields

adhoc_search_level · string

Adhoc search level.

Default: "fast".

base_url · string | null

Splunk base URL (e.g. https://localhost:8089).

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

List indexes

Action ID: tools.splunk.list_indexes

List all indexes on the Splunk server using native Splunk search.

Secrets

Required secrets:

• splunk: required values SPLUNK_API_KEY.

Input fields

adhoc_search_level · string

Adhoc search level.

Default: "fast".

base_url · string | null

Splunk base URL (e.g. https://localhost:8089).

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

List KV collections

Action ID: tools.splunk.list_kv_collections

List all KV Store collections in Splunk.

Reference: https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#get-4

Secrets

Required secrets:

• splunk: required values SPLUNK_API_KEY.

Input fields

app · string

Splunk app context to list collections from (e.g. “search” for default).

Default: "search".

base_url · string | null

Splunk base URL (e.g. https://localhost:8089 or https://tracecat.splunkcloud.com:8089).

Default: null.

limit · integer

Maximum number of collections to return.

Default: 100.

offset · integer

Number of collections to skip for pagination.

Default: 0.

owner · string

Splunk namespace owner for access control (use “nobody” for shared access).

Default: "nobody".

search · string

Search query to filter collections. Example: “name=whitelist” to find collections with “whitelist” in the name.

Default: "".

sort_key · string

Field to sort results by.

Default: "_key".

sort_mode · string

How to sort values (“auto”, “num”, “alpha_case”, or “alpha”).

Default: "auto".

sort_order · string

Sort order (“asc” or “desc”).

Default: "asc".

summarize · boolean

Return summarized response with fewer details for faster response.

Default: false.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

List KV entries

Action ID: tools.splunk.list_kv_entries

List entries in a KV Store collection from Splunk.

Reference: https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#get-6

Secrets

Required secrets:

• splunk: required values SPLUNK_API_KEY.

Input fields

collection · string · required

Name of the KV Store collection to list entries from.

app · string

Splunk app context where the collection resides (e.g. “search” for default).

Default: "search".

base_url · string | null

Splunk base URL (e.g. https://localhost:8089 or https://tracecat.splunkcloud.com:8089).

Default: null.

limit · integer

Maximum number of entries to return.

Default: 100.

offset · integer

Number of entries to skip for pagination.

Default: 0.

owner · string

Splunk namespace owner for access control (use “nobody” for shared access).

Default: "nobody".

query · object

MongoDB-style query to filter entries. Supported operators:

• Conditional: $gt,$gte, $lt,$lte, $ne
• Regex: $regex
• Logical: $and,$or, $not Examples:
• {“title”: “Item”} - Find entries where title equals “Item”
• {“price”: {“$gt”: 5}} - Find entries where price > 5
• {“ip”: {“$regex”: “192.168.1.*”}} - Find entries matching IP pattern

Default: {}.

shared · boolean

Include entries from both specified owner and “nobody” user.

Default: false.

skip · integer

Number of items to skip from the start (alternative to offset).

Default: 0.

sort · string

Field to sort entries by.

Default: "_key".

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

List sourcetypes

Action ID: tools.splunk.list_sourcetypes

List all defined sourcetypes on the Splunk server.

Reference: https://help.splunk.com/en?resourceId=Splunk_RESTREF_RESTsearch&version=splunk-9_4

Secrets

Required secrets:

• splunk: required values SPLUNK_API_KEY.

Input fields

adhoc_search_level · string

Adhoc search level.

Default: "fast".

base_url · string | null

Splunk base URL (e.g. https://localhost:8089).

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Search events

Action ID: tools.splunk.search_events

Search events from Splunk.

Reference: https://help.splunk.com/en?resourceId=Splunk_RESTREF_RESTsearch&version=splunk-9_4#search.2Fjobs

Secrets

Required secrets:

• splunk: required values SPLUNK_API_KEY.

Input fields

end_time · string · required

End time for the search.

limit · integer · required

Maximum number of events to return.

query · string · required

Splunk (Splunk Query Language) search query. You MUST start the query with search, e.g. search index=main | head 10

start_time · string · required

Start time for the search.

adhoc_search_level · string

Adhoc search level.

Default: "fast".

base_url · string | null

Splunk base URL (e.g. https://localhost:8089).

Default: null.

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Submit HEC event

Action ID: tools.splunk.submit_hec_event

Submit an event to Splunk using the HTTP Event Collector (HEC). Uses HEC token authentication.

Reference: https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/9.4/get-data-with-http-event-collector/format-events-for-http-event-collector

Secrets

Required secrets:

• splunk_hec: required values SPLUNK_HEC_TOKEN.

Input fields

event · object · required

Event data to send to Splunk. Can contain any key-value pairs. Example: {“action”: “login”, “username”: “john”, “ip”: “192.168.1.100”}

base_url · string | null

Splunk HEC endpoint URL (e.g. https://localhost:8088 or https://tracecat.splunkcloud.com:8088).

Default: null.

host · string

Host field value for the event.

Default: "tracecat.com".

index · string | null

Splunk index to send the event to. If not specified, uses the default index configured for the HEC token.

Default: null.

source · string

Event source identifier (e.g. application name, script name).

Default: "tracecat_workflow".

sourcetype · string

Event source type for categorization and parsing rules.

Default: "tracecat_log".

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Update KV entry

Action ID: tools.splunk.update_kv_entry

Update an existing entry in a KV Store collection in Splunk.

Reference: https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#post-12

Secrets

Required secrets:

• splunk: required values SPLUNK_API_KEY.

Input fields

collection · string · required

Name of the KV Store collection containing the entry.

entry_key · string · required

The _key value of the entry to update in the collection. Example: “5f3a1b2c3d4e5f6a7b8c9d0e”

fields · object · required

Fields to update in the entry. Only specified fields will be updated. Example: {“status”: “completed”, “updated_at”: “2024-01-15”}

app · string

Splunk app context where the collection resides (e.g. “search” for default).

Default: "search".

base_url · string | null

Splunk base URL (e.g. https://localhost:8089 or https://tracecat.splunkcloud.com:8089).

Default: null.

owner · string

Splunk namespace owner for access control (use “nobody” for shared access).

Default: "nobody".

verify_ssl · boolean

Whether to verify SSL certificates.

Default: true.

Upload CSV to KV Collection

Action ID: tools.splunk.upload_csv_to_kv_collection

Download a CSV file and upload its rows to a Splunk KV Store collection with create, append, or override modes.

Reference: https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions

Secrets

Required secrets:

• splunk: required values SPLUNK_API_KEY.

Input fields

collection · string · required

Name of the KV Store collection to target.

csv_url · string · required

URL pointing to the CSV file to ingest.

app · string

Splunk app context (e.g. search).

Default: "search".

base_url · string | null

Splunk base URL (e.g. https://localhost:8089 or https://example.splunkcloud.com:8089). If not provided, falls back to the workspace variable splunk.base_url.

Default: null.

batch_size · integer

Number of CSV rows to send per request. Lower this if you hit payload limits.

Default: 500.

csv_headers · map[string, string] | null

Optional HTTP headers for downloading the CSV (e.g. Authorization).

Default: null.

mode · string

create: new collection, error if it exists. append: add to existing collection, error if missing. override: replace existing collection if present.

Default: "create".

Allowed values: create, append, override.

owner · string

Splunk namespace owner (use “nobody” for shared access).

Default: "nobody".

verify_ssl · boolean

Whether to verify SSL certificates when downloading and uploading.

Default: true.