Splunk

Interface with Splunk Enterprise for search, alert, report, and user management.

Overview

Splunk is a log analytics and monitoring platform. This tool provides CRUD operations for search jobs, search results, saved searches (reports), fired alerts, alert metrics, and users via the Splunk REST API. Authentication uses a Bearer token. The API returns JSON when output_mode=json is set. Splunk commonly uses self-signed SSL certificates.

Category: Analytics
Tool Name: splunk
Version: 1

Appearance: Icon: si-splunk | Color: #65A637

Node Type

Action — processes input items and produces output

Input / Output

Direction	Port(s)
Input	Input
Output	Output, Error

Credentials

This tool requires Splunk API credentials. See the Credentials Guide for setup instructions.

Resources

Resource	Value
Alert	alert
Report	report
Search	search
User	user

Operations

Each resource has its own Operation list, and several resources reuse the value get or getAll. Pick the resource first, then the operation.

Resource	Operation	Value	Description
Alert	Get Fired Alerts	getReport	Retrieve a fired alerts report
Alert	Get Metrics	getMetrics	Retrieve alert metrics
Report	Create From Search	create	Create a search report from a search job
Report	Delete	deleteReport	Delete a search report
Report	Get	get	Retrieve a search report
Report	Get Many	getAll	Retrieve many search reports
Search	Create	create	Create a search job
Search	Delete	deleteJob	Delete a search job
Search	Get	get	Retrieve a search job
Search	Get Many	getAll	Retrieve many search jobs
Search	Get Result	getResult	Get the result of a search job
User	Create	create	Create a user
User	Delete	deleteUser	Delete a user
User	Get	get	Retrieve a user
User	Get Many	getAll	Retrieve many users
User	Update	update	Update a user

Parameters

The Alert operations Get Fired Alerts and Get Metrics take no parameters of their own.

Search: Create

Parameter	Type	Required	Default	Description
Query (search)	string	Yes	—	Search language string to execute, in Splunk Search Processing Language (SPL). For example search index=_internal | stats count by source.
Additional Fields (additionalFields)	collection	No	{}	Optional search-job settings sent with the dispatch.
— Ad Hoc Search Level	options	No	verbose	—
				Options: fast, smart, verbose
— Auto-Cancel After (Seconds)	number	No	0	Seconds after which the search job automatically cancels.
— Auto-Finalize After (Num Events)	number	No	0	Auto-finalize the search after at least this many events are processed.
— Auto Pause After (Seconds)	number	No	0	Seconds of inactivity after which the search job automatically pauses.
— Earliest Index	string	No	—	The earliest index time for the search (inclusive). ISO 8601 datetime string.
— Earliest Time	string	No	—	The earliest cut-off for the search (inclusive). ISO 8601 datetime string.
— Exec Mode	options	No	blocking	—
				Options: blocking, normal, oneshot
— Indexed Real Time Offset	number	No	0	Seconds of disk sync delay for indexed real-time search.
— Latest Index	string	No	—	The latest index time for the search (inclusive). ISO 8601 datetime string.
— Latest Time	string	No	—	The latest cut-off for the search (inclusive). ISO 8601 datetime string.
— Max Time	number	No	0	Number of seconds to run this search before finalizing. Set 0 to never finalize.
— Namespace	string	No	—	Application namespace in which to restrict searches.
— Reduce Frequency	number	No	0	How frequently to run the MapReduce reduce phase on accumulated map values.
— Remote Server List	string	No	—	Comma-separated list of (possibly wildcarded) servers from which raw events should be pulled.
— Reuse Limit (Seconds)	number	No	0	Number of seconds ago to check when an identical search is started and return the job search ID instead of starting a new job.
— Required Field	string	No	—	Name of a required field to add to the search.
— Search Mode	options	No	normal	—
				Options: normal, realtime
— Status Buckets	number	No	0	The most status buckets to generate. Set 0 to generate no timeline information.
— Timeout	number	No	86400	Number of seconds to keep this search after processing has stopped.
— Workload Pool	string	No	—	New workload pool where the existing running search should be placed.

Search: Delete

Parameter	Type	Required	Default	Description
Search Job ID	string	Yes	—	The ID of the search job.

Search: Get

Parameter	Type	Required	Default	Description
Search Job ID	string	Yes	—	The ID of the search job.

Search: Get Many

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)
Sort	fixedCollection	No	{}	How the returned job list is ordered.
— Sort Direction	options	No	asc	—
				Options: asc, desc
— Sort Key	string	No	—	Key name to use for sorting.
— Sort Mode	options	No	auto	—
				Options: auto (numeric when every value is numeric, otherwise alphabetic), alpha (alphabetic, case-insensitive), alpha_case (alphabetic, case-sensitive), num (numeric)

Search: Get Result

Parameter	Type	Required	Default	Description
Search Job ID	string	Yes	—	The ID of the search job.
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)
Filters (filters)	collection	No	{}	Narrow the rows the job returns.
— Key-Value Match	fixedCollection	No	{}	Filter results by matching a specific field value. Only results where the specified key equals the specified value will be returned.
— — Key	string	No	—	Key to match against.
— — Value	string	No	—	Value to match against.
Options (options)	collection	No	{}	Extra result-retrieval settings.
— Add Summary to Metadata	boolean	No	false	Whether to include field summary statistics in the response.

Report: Create From Search

Parameter	Type	Required	Default	Description
Search Job ID	string	Yes	—	The ID of the search job to create a report from.
Name	string	No	—	The name of the report.

Report: Delete

Parameter	Type	Required	Default	Description
Report ID	string	Yes	—	The ID (name) of the saved search report. Find this in Splunk under Settings > Searches, reports, and alerts.

Report: Get

Parameter	Type	Required	Default	Description
Report ID	string	Yes	—	The ID (name) of the saved search report. Find this in Splunk under Settings > Searches, reports, and alerts.

Report: Get Many

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)
Options (options)	collection	No	{}	Extra listing settings.
— Add Orphan Field	boolean	No	false	Whether to include a boolean value for each saved search to show whether the search is orphaned (has no valid owner).
— List Default Actions	boolean	No	false	Whether to list default action arguments.

User: Create

Parameter	Type	Required	Default	Description
Name	string	Yes	—	Login name of the user.
Roles	string	Yes	user	Comma-separated list of roles to assign to the user. Available roles can be found in Splunk under Settings > Access controls > Roles. Common roles: admin, power, user.
Password	string	Yes	—	Password for the new user.
Additional Fields (additionalFields)	collection	No	{}	Optional profile fields for the new user.
— Email	string	No	—	—
— Full Name (realname)	string	No	—	Full name of the user.

User: Delete

Parameter	Type	Required	Default	Description
User ID	string	Yes	—	The login name (ID) of the user.

User: Get

Parameter	Type	Required	Default	Description
User ID	string	Yes	—	The login name (ID) of the user.

User: Get Many

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)

User: Update

Parameter	Type	Required	Default	Description
User ID	string	Yes	—	The login name (ID) of the user to update.
Update Fields (updateFields)	collection	No	{}	User fields to change. Only the fields you add are sent.
— Email	string	No	—	—
— Full Name (realname)	string	No	—	Full name of the user.
— Password	string	No	—	New password for the user.
— Roles	string	No	—	Comma-separated list of roles to assign. Available roles can be found in Splunk under Settings > Access controls > Roles.

All Operations

Parameter	Type	Required	Default	Description
Max Concurrency	number	No	10	Maximum number of items to process concurrently. Accepts 1–100.

Output Data

Splunk’s response is merged onto the input item’s JSON at the top level — the returned fields sit alongside the fields the item already carried, so downstream nodes address them directly ({{ $json.sid }}). A response field with the same name as an existing item field overwrites it. Binary data on the input item is forwarded unchanged onto every output item.

Multi-record responses fan out. When Splunk returns a list, each record becomes its own output item — still merged onto the same input JSON — so one input item can produce many output items. A list with no records produces no output items for that input.

Operations	Output
Alert Get Fired Alerts and Get Metrics; Report Get Many; Search Get Many; User Get Many	One output item per record in the list.
Search Get Result	One output item per result row the job returned.
Search Create and Get; Report Create From Search and Get; User Create, Get and Update	One output item carrying the returned object.
Search Delete; Report Delete; User Delete	One output item carrying success: true — these calls confirm the change instead of returning a record.

Records that Splunk returns as REST entries — search jobs, saved searches, users, alerts — are flattened before they reach you: the nested content block is lifted to the top level so its fields sit beside name and author, id is shortened to just the final path segment, and the full REST URL is kept as entryUrl. Search Get Result rows are the raw result fields and are not flattened this way.

Search Create returns the dispatched job, whose sid is the search job ID every other search operation needs — pass it on as {{ $json.sid }}.

Usage Examples

• Create a Splunk search job with an SPL query
• Get results from a completed Splunk search job
• List all fired alerts in Splunk
• Create a saved search report from a search job
• Create a new Splunk user with specific roles
• Update a Splunk user email or roles

Example Configuration

Dispatch a search job and wait for it to finish:

{
  "type": "splunk",
  "parameters": {
    "resource": "search",
    "operation": "create",
    "search": "search index=main sourcetype=access_combined | head 100",
    "additionalFields": {
      "earliest_time": "-24h",
      "latest_time": "now",
      "exec_mode": "blocking",
      "timeout": 300
    }
  }
}

Read the rows back from the job the previous node created, keeping only successful requests:

{
  "type": "splunk",
  "parameters": {
    "resource": "search",
    "operation": "getResult",
    "searchJobId": "{{ $json.sid }}",
    "returnAll": false,
    "limit": 50,
    "filters": {
      "keyValueMatch": {
        "keyValuePair": {
          "key": "status",
          "value": "200"
        }
      }
    },
    "options": {
      "add_summary_to_metadata": true
    }
  }
}

List recent search jobs, newest dispatch first:

{
  "type": "splunk",
  "parameters": {
    "resource": "search",
    "operation": "getAll",
    "returnAll": false,
    "limit": 25,
    "sort": {
      "values": {
        "sort_key": "dispatch_time",
        "sort_dir": "desc",
        "sort_mode": "auto"
      }
    }
  }
}

Save a finished search job as a report:

{
  "type": "splunk",
  "parameters": {
    "resource": "report",
    "operation": "create",
    "searchJobId": "{{ $json.sid }}",
    "name": "Daily Access Report"
  }
}

List saved searches and flag the orphaned ones:

{
  "type": "splunk",
  "parameters": {
    "resource": "report",
    "operation": "getAll",
    "returnAll": false,
    "limit": 20,
    "options": {
      "add_orphan_field": true,
      "listDefaultActionArgs": false
    }
  }
}

Create a user with roles and profile details:

{
  "type": "splunk",
  "parameters": {
    "resource": "user",
    "operation": "create",
    "name": "john.doe",
    "password": "{{ $json.temporaryPassword }}",
    "roles": "power,user",
    "additionalFields": {
      "email": "john.doe@company.com",
      "realname": "John Doe"
    }
  }
}

Update a user’s contact details:

{
  "type": "splunk",
  "parameters": {
    "resource": "user",
    "operation": "update",
    "userId": "john.doe",
    "updateFields": {
      "email": "john.doe@newcompany.com",
      "realname": "John D. Doe"
    }
  }
}

Pull the fired-alerts report:

{
  "type": "splunk",
  "parameters": {
    "resource": "alert",
    "operation": "getMetrics"
  }
}

Error Handling

Mode	Behavior
stop	Halts workflow on first error
continue	Skips failed items, passes successful ones through
errorPort	Routes failed items to Error output port

Tips

Use Splunk to create and manage search jobs, retrieve search results, manage saved searches (reports), monitor alerts, and administer users on a Splunk Enterprise instance.

The Search Workflow Pattern

1. Create a search job with your SPL query. Leave Exec Mode on blocking so the node returns only once Splunk has finished, and read the job’s sid from the output.
2. Get Result with that sid to retrieve the rows, one output item per row.
3. Optionally Create From Search to save the same query as a report you can schedule inside Splunk.

Get on a search job is useful in between when you dispatch with normal mode and want to inspect the job’s progress before reading results.

Key Parameter Dependencies

• The Operation list depends entirely on the selected Resource.
• Limit only appears when Return All is off. Turning Return All on asks Splunk for the complete set.
• Collections (Additional Fields, Update Fields, Filters, Options) are flat objects keyed by the sub-field’s internal name.
• The Sort fixed collection nests under the group key values, and Key-Value Match nests under keyValuePair. Both hold a single record, not a list.