Reference · built on requestConnectorIdentity, IT & observability

Splunk

Search jobs, saved searches, alert incidents, and KV Store collections across Splunk Enterprise and Cloud via the REST API.

Request accessPricing ↗

About

Splunk is a data platform for searching, monitoring, and analyzing machine-generated big data via Search Processing Language. The Splunk REST API at port 8089 on Enterprise deployments or standard Cloud endpoints manages search jobs, retrieves saved search results, inspects fired alert incidents, and interacts with KV Store collections.

Through Fibric, an operator monitors security signals and operational error logs, proposing search dispatches or alert acknowledgments for human confirmation.

This is a reference listing. It documents what Fibric would read from Splunk and what it could propose, based on the vendor's published interfaces. Fibric builds it under a managed deployment when you request it; selecting it here installs nothing.

Inputs

  • Search jobs and job execution progress via GET /services/search/v2/jobs
  • Search results and summary events through GET /services/search/v2/jobs/{search_id}/results
  • Saved searches and scheduled report configurations from GET /services/saved/searches
  • Fired alert incidents and trigger times through GET /services/alerts/fired_alerts
  • KV Store collections and record lookups via GET /services/storage/collections/data/{collection}
  • Index status, event counts, and disk usage metrics from GET /services/data/indexes

Proposed actions

  • Target capability: propose dispatching a search job via POST /services/search/v2/jobs
  • Target capability: propose acknowledging or resolving a fired alert incident
  • Target capability: propose creating or updating a record in a KV Store collection
  • Target capability: propose updating a saved search schedule or alert action

Proposed actions are target capabilities. Every action runs propose-first and needs a validated deployment and the appropriate permissions.

What you can build

  • Investigate security access anomalies

    When identity providers detect suspicious sign-ins, dispatch Splunk searches across firewall and VPN logs, proposing evidence summaries for security analysts.

    With Access Review, Audit Trail

  • Correlate infrastructure errors during outages

    During system degradation events, query Splunk index patterns for sudden 5xx surges across web tiers, proposing service triage priorities.

    With Uptime Response, On-call Handoff

  • Reconcile audit logs for compliance reviews

    Query saved compliance searches to gather administrative login events and export structured audit records for quarterly compliance checklists.

    With Compliance Evidence

Requirements

  • A Splunk Enterprise or Splunk Cloud deployment with the REST API port accessible
  • A Splunk user role with search, rest_properties_get, and rest_properties_set capabilities
  • Network routing permitting HTTPS connections to the management interface
Authentication
Splunk authentication token (JWT) or session key passed via an Authorization Bearer header to the Splunk REST management port.

Limits

  • Search concurrency caps restrict the number of simultaneous searches executed per user role
  • Subsearch execution limits cap subsearch results at 10,000 events by default
  • REST management endpoints on Splunk Enterprise operate on port 8089 requiring firewall allowances

Access and pricing

Reference listing. Fibric builds the connector under a managed deployment when you request it. Your quote covers the build, capabilities, usage, and support.

Request Splunk ↗

Questions and answers

Does this connector support Splunk Cloud and Splunk Enterprise?
Yes. It communicates over Splunk's REST API, which is identical across Splunk Cloud Platform and on-premises Splunk Enterprise installations. Cloud instances require routing through the designated API access URL.
How does Fibric run SPL queries in Splunk?
Fibric creates an asynchronous search job via POST /services/search/v2/jobs, polls the job status until completion, and retrieves the formatted result rows in JSON or CSV format.
Can Fibric delete or modify indexed log data in Splunk?
No. Splunk indexes are immutable by design. Fibric only queries indexed logs and proposes non-destructive workflow updates such as acknowledging fired alerts or writing lookup tables.
Ask about Splunk

Ask about the capabilities and requirements in this listing.

For project-specific requirements, contact Fibric.

This connector listing is developed, published, and supported by Fibric. It describes integration with Splunk through published interfaces. Third-party names and logos identify the systems an integration connects to; they are the property of their respective owners, who are not affiliated with Fibric and do not sponsor or endorse this listing. Trademark policy