<!-- BusyBot node reference — https://busybot.net/tools/splunk/ -->

> Node: Splunk (`splunk`) · Action · v1
> Category: Analytics · Credentials: Splunk API (`splunkApi`)
> Updated: 2026-08-16

# Splunk

> Interface with Splunk Enterprise for search, alert, report, and user management.

## Overview

Splunk is a log analytics and monitoring platform. This tool provides CRUD operations for search jobs, search results, saved searches (reports), fired alerts, alert metrics, and users via the Splunk REST API. Authentication uses a Bearer token. The API returns JSON when output_mode=json is set. Splunk commonly uses self-signed SSL certificates.

**Category:** Analytics  
**Tool Name:** `splunk`  
**Version:** 1

**Appearance:** Icon: `si-splunk` | Color: `#65A637`

## Node Type

**Action** — processes input items and produces output

## Input / Output

| Direction | Port(s) |
|-----------|--------|
| Input | `Input` |
| Output | `Output`, `Error` |

## Credentials

This tool requires **Splunk API** credentials.
See the [Credentials Guide](https://busybot.net/credentials/splunk-api/) for setup instructions.

### Resources

| Resource | Value |
|----------|-------|
| Alert | `alert` |
| Report | `report` |
| Search | `search` |
| User | `user` |

### Operations

Each resource has its own Operation list, and several resources reuse the value `get` or `getAll`. Pick the resource first, then the operation.

| Resource | Operation | Value | Description |
|----------|-----------|-------|-------------|
| Alert | Get Fired Alerts | `getReport` | Retrieve a fired alerts report |
| Alert | Get Metrics | `getMetrics` | Retrieve alert metrics |
| Report | Create From Search | `create` | Create a search report from a search job |
| Report | Delete | `deleteReport` | Delete a search report |
| Report | Get | `get` | Retrieve a search report |
| Report | Get Many | `getAll` | Retrieve many search reports |
| Search | Create | `create` | Create a search job |
| Search | Delete | `deleteJob` | Delete a search job |
| Search | Get | `get` | Retrieve a search job |
| Search | Get Many | `getAll` | Retrieve many search jobs |
| Search | Get Result | `getResult` | Get the result of a search job |
| User | Create | `create` | Create a user |
| User | Delete | `deleteUser` | Delete a user |
| User | Get | `get` | Retrieve a user |
| User | Get Many | `getAll` | Retrieve many users |
| User | Update | `update` | Update a user |

### Parameters

The **Alert** operations `Get Fired Alerts` and `Get Metrics` take no parameters of their own.

#### Search: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Query (`search`) | `string` | Yes | — | Search language string to execute, in Splunk Search Processing Language (SPL). For example `search index=_internal \| stats count by source`. |
| Additional Fields (`additionalFields`) | `collection` | No | `{}` | Optional search-job settings sent with the dispatch. |
| — Ad Hoc Search Level | `options` | No | `verbose` | — |
| | | | | Options: `fast`, `smart`, `verbose` |
| — Auto-Cancel After (Seconds) | `number` | No | `0` | Seconds after which the search job automatically cancels. |
| — Auto-Finalize After (Num Events) | `number` | No | `0` | Auto-finalize the search after at least this many events are processed. |
| — Auto Pause After (Seconds) | `number` | No | `0` | Seconds of inactivity after which the search job automatically pauses. |
| — Earliest Index | `string` | No | — | The earliest index time for the search (inclusive). ISO 8601 datetime string. |
| — Earliest Time | `string` | No | — | The earliest cut-off for the search (inclusive). ISO 8601 datetime string. |
| — Exec Mode | `options` | No | `blocking` | — |
| | | | | Options: `blocking`, `normal`, `oneshot` |
| — Indexed Real Time Offset | `number` | No | `0` | Seconds of disk sync delay for indexed real-time search. |
| — Latest Index | `string` | No | — | The latest index time for the search (inclusive). ISO 8601 datetime string. |
| — Latest Time | `string` | No | — | The latest cut-off for the search (inclusive). ISO 8601 datetime string. |
| — Max Time | `number` | No | `0` | Number of seconds to run this search before finalizing. Set 0 to never finalize. |
| — Namespace | `string` | No | — | Application namespace in which to restrict searches. |
| — Reduce Frequency | `number` | No | `0` | How frequently to run the MapReduce reduce phase on accumulated map values. |
| — Remote Server List | `string` | No | — | Comma-separated list of (possibly wildcarded) servers from which raw events should be pulled. |
| — Reuse Limit (Seconds) | `number` | No | `0` | Number of seconds ago to check when an identical search is started and return the job search ID instead of starting a new job. |
| — Required Field | `string` | No | — | Name of a required field to add to the search. |
| — Search Mode | `options` | No | `normal` | — |
| | | | | Options: `normal`, `realtime` |
| — Status Buckets | `number` | No | `0` | The most status buckets to generate. Set 0 to generate no timeline information. |
| — Timeout | `number` | No | `86400` | Number of seconds to keep this search after processing has stopped. |
| — Workload Pool | `string` | No | — | New workload pool where the existing running search should be placed. |

#### Search: Delete

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Search Job ID | `string` | Yes | — | The ID of the search job. |

#### Search: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Search Job ID | `string` | Yes | — | The ID of the search job. |

#### Search: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |
| Sort | `fixedCollection` | No | `{}` | How the returned job list is ordered. |
| — Sort Direction | `options` | No | `asc` | — |
| | | | | Options: `asc`, `desc` |
| — Sort Key | `string` | No | — | Key name to use for sorting. |
| — Sort Mode | `options` | No | `auto` | — |
| | | | | Options: `auto` (numeric when every value is numeric, otherwise alphabetic), `alpha` (alphabetic, case-insensitive), `alpha_case` (alphabetic, case-sensitive), `num` (numeric) |

#### Search: Get Result

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Search Job ID | `string` | Yes | — | The ID of the search job. |
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |
| Filters (`filters`) | `collection` | No | `{}` | Narrow the rows the job returns. |
| — Key-Value Match | `fixedCollection` | No | `{}` | Filter results by matching a specific field value. Only results where the specified key equals the specified value will be returned. |
| — — Key | `string` | No | — | Key to match against. |
| — — Value | `string` | No | — | Value to match against. |
| Options (`options`) | `collection` | No | `{}` | Extra result-retrieval settings. |
| — Add Summary to Metadata | `boolean` | No | `false` | Whether to include field summary statistics in the response. |

#### Report: Create From Search

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Search Job ID | `string` | Yes | — | The ID of the search job to create a report from. |
| Name | `string` | No | — | The name of the report. |

#### Report: Delete

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Report ID | `string` | Yes | — | The ID (name) of the saved search report. Find this in Splunk under Settings > Searches, reports, and alerts. |

#### Report: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Report ID | `string` | Yes | — | The ID (name) of the saved search report. Find this in Splunk under Settings > Searches, reports, and alerts. |

#### Report: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |
| Options (`options`) | `collection` | No | `{}` | Extra listing settings. |
| — Add Orphan Field | `boolean` | No | `false` | Whether to include a boolean value for each saved search to show whether the search is orphaned (has no valid owner). |
| — List Default Actions | `boolean` | No | `false` | Whether to list default action arguments. |

#### User: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Name | `string` | Yes | — | Login name of the user. |
| Roles | `string` | Yes | `user` | Comma-separated list of roles to assign to the user. Available roles can be found in Splunk under Settings > Access controls > Roles. Common roles: admin, power, user. |
| Password | `string` | Yes | — | Password for the new user. |
| Additional Fields (`additionalFields`) | `collection` | No | `{}` | Optional profile fields for the new user. |
| — Email | `string` | No | — | — |
| — Full Name (`realname`) | `string` | No | — | Full name of the user. |

#### User: Delete

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| User ID | `string` | Yes | — | The login name (ID) of the user. |

#### User: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| User ID | `string` | Yes | — | The login name (ID) of the user. |

#### User: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |

#### User: Update

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| User ID | `string` | Yes | — | The login name (ID) of the user to update. |
| Update Fields (`updateFields`) | `collection` | No | `{}` | User fields to change. Only the fields you add are sent. |
| — Email | `string` | No | — | — |
| — Full Name (`realname`) | `string` | No | — | Full name of the user. |
| — Password | `string` | No | — | New password for the user. |
| — Roles | `string` | No | — | Comma-separated list of roles to assign. Available roles can be found in Splunk under Settings > Access controls > Roles. |

#### All Operations

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Max Concurrency | `number` | No | `10` | Maximum number of items to process concurrently. Accepts 1–100. |

## Output Data

Splunk's response is **merged onto the input item's JSON** at the top level — the returned fields sit alongside the fields the item already carried, so downstream nodes address them directly (`{{ $json.sid }}`). A response field with the same name as an existing item field overwrites it. Binary data on the input item is forwarded unchanged onto every output item.

**Multi-record responses fan out.** When Splunk returns a list, each record becomes its own output item — still merged onto the same input JSON — so one input item can produce many output items. A list with no records produces no output items for that input.

| Operations | Output |
|------------|--------|
| Alert Get Fired Alerts and Get Metrics; Report Get Many; Search Get Many; User Get Many | **One output item per record** in the list. |
| Search Get Result | **One output item per result row** the job returned. |
| Search Create and Get; Report Create From Search and Get; User Create, Get and Update | One output item carrying the returned object. |
| Search Delete; Report Delete; User Delete | One output item carrying `success: true` — these calls confirm the change instead of returning a record. |

Records that Splunk returns as REST *entries* — search jobs, saved searches, users, alerts — are flattened before they reach you: the nested `content` block is lifted to the top level so its fields sit beside `name` and `author`, `id` is shortened to just the final path segment, and the full REST URL is kept as `entryUrl`. Search **Get Result** rows are the raw result fields and are not flattened this way.

Search **Create** returns the dispatched job, whose `sid` is the search job ID every other search operation needs — pass it on as `{{ $json.sid }}`.

## Usage Examples

- Create a Splunk search job with an SPL query
- Get results from a completed Splunk search job
- List all fired alerts in Splunk
- Create a saved search report from a search job
- Create a new Splunk user with specific roles
- Update a Splunk user email or roles

## Example Configuration

Dispatch a search job and wait for it to finish:

```json
{
  "type": "splunk",
  "parameters": {
    "resource": "search",
    "operation": "create",
    "search": "search index=main sourcetype=access_combined | head 100",
    "additionalFields": {
      "earliest_time": "-24h",
      "latest_time": "now",
      "exec_mode": "blocking",
      "timeout": 300
    }
  }
}
```

Read the rows back from the job the previous node created, keeping only successful requests:

```json
{
  "type": "splunk",
  "parameters": {
    "resource": "search",
    "operation": "getResult",
    "searchJobId": "{{ $json.sid }}",
    "returnAll": false,
    "limit": 50,
    "filters": {
      "keyValueMatch": {
        "keyValuePair": {
          "key": "status",
          "value": "200"
        }
      }
    },
    "options": {
      "add_summary_to_metadata": true
    }
  }
}
```

List recent search jobs, newest dispatch first:

```json
{
  "type": "splunk",
  "parameters": {
    "resource": "search",
    "operation": "getAll",
    "returnAll": false,
    "limit": 25,
    "sort": {
      "values": {
        "sort_key": "dispatch_time",
        "sort_dir": "desc",
        "sort_mode": "auto"
      }
    }
  }
}
```

Save a finished search job as a report:

```json
{
  "type": "splunk",
  "parameters": {
    "resource": "report",
    "operation": "create",
    "searchJobId": "{{ $json.sid }}",
    "name": "Daily Access Report"
  }
}
```

List saved searches and flag the orphaned ones:

```json
{
  "type": "splunk",
  "parameters": {
    "resource": "report",
    "operation": "getAll",
    "returnAll": false,
    "limit": 20,
    "options": {
      "add_orphan_field": true,
      "listDefaultActionArgs": false
    }
  }
}
```

Create a user with roles and profile details:

```json
{
  "type": "splunk",
  "parameters": {
    "resource": "user",
    "operation": "create",
    "name": "john.doe",
    "password": "{{ $json.temporaryPassword }}",
    "roles": "power,user",
    "additionalFields": {
      "email": "john.doe@company.com",
      "realname": "John Doe"
    }
  }
}
```

Update a user's contact details:

```json
{
  "type": "splunk",
  "parameters": {
    "resource": "user",
    "operation": "update",
    "userId": "john.doe",
    "updateFields": {
      "email": "john.doe@newcompany.com",
      "realname": "John D. Doe"
    }
  }
}
```

Pull the fired-alerts report:

```json
{
  "type": "splunk",
  "parameters": {
    "resource": "alert",
    "operation": "getMetrics"
  }
}
```

### Error Handling

| Mode | Behavior |
|------|----------|
| **stop** | Halts workflow on first error |
| **continue** | Skips failed items, passes successful ones through |
| **errorPort** | Routes failed items to Error output port |

## Tips

Use Splunk to create and manage search jobs, retrieve search results, manage saved searches (reports), monitor alerts, and administer users on a Splunk Enterprise instance.

### The Search Workflow Pattern

1. **Create** a search job with your SPL query. Leave **Exec Mode** on `blocking` so the node returns only once Splunk has finished, and read the job's `sid` from the output.
2. **Get Result** with that `sid` to retrieve the rows, one output item per row.
3. Optionally **Create From Search** to save the same query as a report you can schedule inside Splunk.

`Get` on a search job is useful in between when you dispatch with `normal` mode and want to inspect the job's progress before reading results.

### Key Parameter Dependencies

- The **Operation** list depends entirely on the selected **Resource**.
- **Limit** only appears when **Return All** is off. Turning Return All on asks Splunk for the complete set.
- Collections (**Additional Fields**, **Update Fields**, **Filters**, **Options**) are flat objects keyed by the sub-field's internal name.
- The **Sort** fixed collection nests under the group key `values`, and **Key-Value Match** nests under `keyValuePair`. Both hold a single record, not a list.
</content>