Cisco Splunk

The Cisco Splunk connector enables seamless integration between Swimlane's automation capabilities and Splunk's data analytics, providing a robust solution for operational intelligence and security incident management.

Cisco Splunk is a powerful platform for searching, monitoring, and analyzing machine-generated big data. This connector enables Swimlane Turbine users to automate incident logging, search execution, and data analysis within Splunk. By integrating with Cisco Splunk, users can create and manage events, initiate searches, dispatch saved searches, and update notable events directly from Swimlane Turbine. This enhances the efficiency of security operations by streamlining data analysis and incident response workflows.

Limitations

None to date.

Supported Versions

Splunk Enterprise

Splunk Cloud

V1 or V2 endpoints will be called based on the version in the asset configuration. Defaults to 9.0.1

Additional Docs

Splunk's REST API Reference

Configuration

Prerequisites

To effectively utilize the Cisco Splunk connector for Swimlane Turbine, ensure you have the following prerequisites:

HTTP Basic Authentication with these parameters:

URL: Endpoint for the Cisco Splunk API.

Username: Your Cisco Splunk account username.

Password: Your Cisco Splunk account password.

HTTP Bearer Authentication with these parameters:

URL: Endpoint for the Cisco Splunk API.

Token: A valid bearer token such as JWT for authentication.

Authentication Methods

To effectively utilize the Cisco Splunk connector with Swimlane Turbine, ensure you have the following prerequisites:

HTTP Basic Authentication with the following parameters:

URL: Endpoint for the Splunk API.

Username: Your Splunk account username.

Password: Your Splunk account password.

HTTP Bearer Token Authentication with the following parameters:

URL: Endpoint for the Splunk API.

Token: A valid bearer token such as a JWT for authenticating API requests.

Generally, the port must be set to 8089 when connecting to Splunk.

Capabilities

The Cisco Splunk connector has the following capabilities:

Create Event

Create Search

Dispatch Name Saved Search

Edit Notable Events

Get Saved Search

Get Search

Get Search Results

One-Shot Search

Run Search with Polling

Generic

Actions that contain the output_mode parameter allow for:

json - JSON output (default)

csv - CSV output.

xml - XML output.

raw - Raw output.

Create Event

Create events from the contents contained in the HTTP body.

The edit_tcp capability is additionally required for this endpoint.

Create Search

This action will not return the search results. This action will return the search id. It is important that the search might take some time in Splunk and might not be immediately available for fetching the results.

data_body examples:

Search for notable events in the last 5 minutes

  search: 'search index=notable earliest=-5m'

Count HTTP 200 responses grouped by URI path:

  search: 'search sourcetype=access_combined status=200 | stats count by uri_path'

Lookup data from a CSV file

  search: '| inputlookup mylookup'

Splunk's documentation for this endpoint can be found here

Edit Notable Events

Splunk's documentation for this endpoint can be found here

Get Saved Search

Access the named saved search.

Splunk's documentation for this endpoint can be found here

Get Search

The user ID is implied by the authentication to the call.

The dispatchState field can be one of the following values:

QUEUED

PARSING

RUNNING

FINALIZING

DONE

PAUSE

INTERNAL_CANCEL

USER_CANCEL

BAD_INPUT_CANCEL

QUIT

FAILED

Splunk's documentation for this endpoint can be found here

Get Search Results

The output_mode parameter for this action allows for:

json - JSON output (default)

csv - CSV output.

xml - XML output.

raw - Raw output.

json_cols - JSON output with columns.

json_rows - JSON output with rows.

row - Row output.

atom - Atom output.

Splunks documentation for this endpoint can be found here

One-Shot Search

This action will run a search and return the results in a single call.

Inputs

Search:

Retrieve the first 10 events from the _internal index:

  search_string: 'index=_internal | head 10

Find and count 404 errors by URI path:

  search_string: 'search sourcetype=access_combined status=404 | stats count by uri_path'

Use tstats to count events by host:

  search_string: '| tstats count where index=* by host'

add_search:

If set to true, the keyword search will be prepended to your search_string unless it already starts with a pipe (|) or another generating command.

add_search: true
search_string: 'index=main error'
## The executed search will be: 'search index=main error'

add_search: false
search_string: '| inputlookup my_lookup_table'
## The executed search will be: '| inputlookup my_lookup_table'

earliest_time and latest_time:

earliest_time: '-1h'

earliest_time: '2023-07-01T00:00:00Z'

app:

Run search in the default Search app:

app: 'search'

Run search in the Search & Reporting app:

app: 'SplunkEnterpriseSecuritySuite'

parse_json:

Due to a known Splunk issue with malformed JSON outputs, setting this to true will attempt to correct and parse the JSON response

Configurations

HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Username	string	Required
password	Password	string	Required
splunk_enterprise_version	Splunk Enterprise version to call updated endpoints as from 9.0.1 version, v1 instances of some endpoints are deprecated, and v2 instances of these endpoints are available.	string	Optional
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

HTTP Bearer Authentication

Authenticates using bearer token such as a JWT, etc.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
token	The API key, token, etc.	string	Required
splunk_enterprise_version	Splunk Enterprise version to call updated endpoints as from 9.0.1 version, v1 instances of some endpoints are deprecated, and v2 instances of these endpoints are available.	string	Optional
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Create Event

Creates a new event in Cisco Splunk for incident logging and tracking with specified output mode.

Endpoint

URL: services/receivers/simple

Method: POST

Input

Argument Name	Type	Required	Description
parameters.output_mode	string	Required	Parameters for the Create Event action
data_body	string	Optional	Response data

Input Example

{"parameters":{"output_mode":"json"},"data_body":"string"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
index	string	Output field: index
bytes	number	Output field: bytes
host	string	Output field: host
source	string	Output field: source
sourcetype	string	Type of the resource

Output Example

{"index":"string","bytes":123,"host":"string","source":"string","sourcetype":"string"}

Create Search

Initiates a new search in Cisco Splunk with the specified output mode, returning the search ID for subsequent operations.

Endpoint

URL: services/search/jobs

Method: POST

Input

Argument Name	Type	Required	Description
parameters.output_mode	string	Required	Parameters for the Create Search action
headers	object	Optional	HTTP headers for the request
headers.Content-Type	string	Optional	HTTP headers for the request
data_body	object	Optional	Response data
data_body.search	string	Optional	Response data

Input Example

{"headers":{"Content-Type":"application/x-www-form-urlencoded"},"data_body":{"search":"search index=notable earliest=-5m"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
links	object	Output field: links
origin	string	Output field: origin
updated	string	Output field: updated
generator	object	Output field: generator
generator.build	string	Output field: generator.build
generator.version	string	Output field: generator.version
entry	array	Output field: entry
entry.name	string	Name of the resource
entry.id	string	Unique identifier
entry.updated	string	Output field: entry.updated
entry.links	object	Output field: entry.links
entry.links.alternate	string	Output field: entry.links.alternate
entry.links.search_telemetry.json	string	Output field: entry.links.search_telemetry.json
entry.links.search.log	string	Output field: entry.links.search.log
entry.links.events	string	Output field: entry.links.events
entry.links.results	string	Result of the operation
entry.links.results_preview	string	Result of the operation
entry.links.timeline	string	Output field: entry.links.timeline
entry.links.summary	string	Output field: entry.links.summary
entry.links.control	string	Output field: entry.links.control
entry.published	string	Output field: entry.published
entry.author	string	Output field: entry.author
entry.content	object	Response content

Output Example

{"links":{},"origin":"string","updated":"2024-01-01T00:00:00Z","generator":{"build":"string","version":"string"},"entry":[{"name":"Example Name","id":"12345678-1234-1234-1234-123456789abc","updated":"2024-01-01T00:00:00Z","links":{},"published":"string","author":"string","content":{},"acl":{}}],"paging":{"total":123,"perPage":123,"offset":123}}

Dispatch Name Saved Search

Executes a predefined saved search in Cisco Splunk using the provided 'name' path parameter.

Endpoint

URL: /services/saved/searches/{{name}}/dispatch

Method: POST

Input

Argument Name	Type	Required	Description
data_body	object	Required	Response data
data_body.args.index_name	string	Optional	Arg values to create a saved search is the saved search if a template search.
data_body.dispatchAs	string	Optional	Indicate the user context, quota, and access rights for the saved search. The saved search runs according to the context indicated.
data_body.dispatch.now	boolean	Optional	Dispatch the search as if the specified time for this parameter was the current time.
data_body.dispatch.adhoc_search_level	string	Optional	The level of adhoc search to run. The default is smart, which runs the search at the level specified in the saved search.
data_body.force_dispatch	boolean	Optional	Indicates whether to start a new search even if another instance of this search is already running.
data_body.trigger_actions	string	Optional	Indicates whether to trigger alert actions.
data_body.replay_speed	number	Optional	Indicate a real-time search replay speed factor. For example, 1 indicates normal speed. 0.5 indicates half of normal speed, and 2 indicates twice as fast as normal. earliest_time and latest_time arguments must indicate a real-time time range to use replay options.
data_body.replay_et	string	Optional	Relative "wall clock" start time for the replay.
data_body.replay_lt	string	Optional	Relative end time for the replay clock. The replay stops when clock time reaches this time.
path_parameters.name	string	Required	The name of the saved search to dispatch.

Input Example

{"data_body":{"args.index_name":"my_index","dispatchAs":"owner","dispatch.now":true,"dispatch.adhoc_search_level":"smart","force_dispatch":true,"trigger_actions":"true","replay_speed":2,"replay_et":"-1d@d","replay_lt":"-@d"},"path_parameters":{"name":"MySavedSearch"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Edit Notable Event

Update existing Notable Events in Cisco Splunk with specified details using the provided data body.

Endpoint

URL: services/notable_update

Method: POST

Input

Argument Name	Type	Required	Description
data_body	object	Required	Response data
data_body.ruleUIDs	array	Required	Response data
data_body.searchID	string	Optional	Response data
data_body.newOwner	string	Optional	Response data
data_body.urgency	string	Optional	Response data
data_body.status	string	Optional	Response data
data_body.comment	string	Optional	Response data
data_body.disposition	string	Optional	An ID for a disposition that matches a disposition in the reviewstatuses.conf configuration file. Required only if you are changing the disposition of the event.

Input Example

{"data_body":{"ruleUIDs":["29439FBC-FFCB-45FF-93C2-420202012E1E","38439BBC-EECB-44FF-91C2-420121A12E12"],"searchID":"An example search ID","newOwner":"An example owner","urgency":"An example urgency","status":"An example status","comment":"An example comment","disposition":"disposition:2"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
message	string	Response message
failure_count	number	Count value
success	boolean	Whether the operation was successful
success_count	number	Whether the operation was successful

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 17 Jul 2023 20:53:02 GMT","Expires":"Thu, 26 Oct 1978 00:00:00 GMT","Cache-Control":"no-store, no-cache, must-revalidate, max-age=0","Content-Type":"application/json; charset=UTF-8","X-Content-Type-Options":"nosniff","Transfer-Encoding":"chunked","Content-Encoding":"gzip","Vary":"Accept-Encoding, Cookie, Authorization","Connection":"Keep-Alive","X-Frame-Options":"SAMEORIGIN","Server":"Splunkd"},"reason":"OK","json_body":{"message":"","failure_c...

Get Saved Search

Retrieves a formatted saved search from Cisco Splunk using the 'name' and 'output_mode' parameters.

Endpoint

URL: services/saved/searches/{{name}}

Method: GET

Input

Argument Name	Type	Required	Description
parameters.output_mode	string	Required	Parameters for the Get Saved Search action
path_parameters.name	string	Required	Parameters for the Get Saved Search action

Input Example

{"parameters":{"output_mode":"json"},"path_parameters":{"name":"Example Name"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
links	object	Output field: links
links.create	string	Output field: links.create
links._reload	string	Output field: links._reload
links._acl	string	Output field: links._acl
origin	string	Output field: origin
updated	string	Output field: updated
generator	object	Output field: generator
generator.build	string	Output field: generator.build
generator.version	string	Output field: generator.version
entry	array	Output field: entry
entry.name	string	Name of the resource
entry.id	string	Unique identifier
entry.updated	string	Output field: entry.updated
entry.links	object	Output field: entry.links
entry.links.alternate	string	Output field: entry.links.alternate
entry.links.list	string	Output field: entry.links.list
entry.links._reload	string	Output field: entry.links._reload
entry.links.edit	string	Output field: entry.links.edit
entry.links.acknowledge	string	Output field: entry.links.acknowledge
entry.links.disable	string	Output field: entry.links.disable
entry.links.dispatch	string	Output field: entry.links.dispatch
entry.links.embed	string	Output field: entry.links.embed
entry.links.history	string	Output field: entry.links.history

Output Example

{"links":{"create":"string","_reload":"string","_acl":"string"},"origin":"string","updated":"2024-01-01T00:00:00Z","generator":{"build":"string","version":"string"},"entry":[{"name":"Example Name","id":"12345678-1234-1234-1234-123456789abc","updated":"2024-01-01T00:00:00Z","links":{},"author":"string","acl":{},"fields":{},"content":{}}],"paging":{"total":123,"perPage":123,"offset":123},"messages":[{"file_name":"Example Name","file":"string"}]}

Get Search

Obtain results for a specific search in Cisco Splunk using the provided search ID and selected output mode.

Endpoint

URL: services/search/jobs/{{search_id}}

Method: GET

Input

Argument Name	Type	Required	Description
parameters.output_mode	string	Required	Parameters for the Get Search action
path_parameters.search_id	string	Required	Parameters for the Get Search action

Input Example

{"parameters":{"output_mode":"json"},"path_parameters":{"search_id":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
links	object	Output field: links
origin	string	Output field: origin
updated	string	Output field: updated
generator	object	Output field: generator
generator.build	string	Output field: generator.build
generator.version	string	Output field: generator.version
entry	array	Output field: entry
entry.name	string	Name of the resource
entry.id	string	Unique identifier
entry.updated	string	Output field: entry.updated
entry.links	object	Output field: entry.links
entry.links.alternate	string	Output field: entry.links.alternate
entry.links.search_telemetry.json	string	Output field: entry.links.search_telemetry.json
entry.links.search.log	string	Output field: entry.links.search.log
entry.links.events	string	Output field: entry.links.events
entry.links.results	string	Result of the operation
entry.links.results_preview	string	Result of the operation
entry.links.timeline	string	Output field: entry.links.timeline
entry.links.summary	string	Output field: entry.links.summary
entry.links.control	string	Output field: entry.links.control
entry.published	string	Output field: entry.published
entry.author	string	Output field: entry.author
entry.content	object	Response content

Output Example

Get Search Results

Obtain the results of a specified search in Cisco Splunk using the provided search ID and output mode.

Input

Argument Name	Type	Required	Description
output_mode	string	Required	Parameter for Get Search Results
search_id	string	Required	Unique identifier
count	number	Optional	The maximum number of results to return.
offset	number	Optional	The first result from which to begin returning data.

Input Example

{"output_mode":"json","search_id":"1707831160.17704","count":10,"offset":0}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
messages	array	Response message
messages.type	string	Type of the resource
messages.text	string	Response message

Output Example

{"messages":[{"type":"string","text":"string"}]}

One-shot Search

Performs a one-time search in Cisco Splunk using a specified string and imports the results directly into Swimlane records. A 'search_string' is required.

Input

Argument Name	Type	Required	Description
search_string	string	Required	Splunk Search Query. Eg index=_internal	head 10
add_search	boolean	Optional	If True 'search' will be added to the start of the search string. false will leave the 'search' prefix. Defaults to 'True'.
earliest_time	string	Optional	This can be any standard datetime format supported by pendulum or a relative datetime. Format example is 2020-01-18T18:34:04Z or -1h
latest_time	string	Optional	This can be any standard datetime format supported by pendulum or a relative datetime. Format example is 2020-01-18T18:34:04Z -1h
owner	string	Optional	The owner's Splunk username. Eg admin
app	string	Optional	The app to run the search in. Eg search
parse_json	boolean	Optional	Splunk has a know bug that causes the JSON to be malformed. This will attempt to fix the JSON before parsing it. Defaults to true.
latest_result_head	boolean	Optional	Returns the first result of response.
latest_result_tail	boolean	Optional	Returns the last result of response.

Input Example

{"search_string":"string","add_search":true,"earliest_time":"string","latest_time":"string","owner":"string","app":"string","parse_json":true,"latest_result_head":true,"latest_result_tail":true}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"json_body":[{"_bkt":"main~347~8A6B8C24-39C2-41D1-A0DE-53A1E4936F43","_cd":"347:962465689","_indextime":"1688236453","_raw":"{\"attributes\":{\"logging.googleapis.com/timestamp\":\"2023-07-01T18:34:03.14Z\"},\"publish_time\":1593195281.507,\"data\":{\"insertId\":\"bnn247d1uuw\",\"protoPayload\":{\"resourceName\":\"projects/344444931094/zones/<#token_region#>/instances/<#token_instance_name#>\",\"authenticationInfo\":{\"principalEmail\":\"[email protected]\"},\"serviceName\":\"compute.googlea...

Run Search with Polling

Executes and polls a long-running search in Cisco Splunk until completion or timeout, using the specified 'search_string'.

Endpoint

URL: /services/search/jobs

Method: POST

Input

Argument Name	Type	Required	Description
search_string	string	Required	The Splunk search query string to run. Example- index=_internal	head 10.
output_mode	string	Optional	Parameter for Run Search with Polling
add_search	boolean	Optional	If true, prepends 'search' to the search string automatically. Default is true.
timeout	integer	Optional	Maximum number of seconds to wait for the search to complete before timing out. Default is 600 seconds (10 minutes).
poll_interval	integer	Optional	Interval in seconds between each status check. Default is 10 seconds.
count	number	Optional	The maximum number of results to return.
offset	number	Optional	The first result from which to begin returning data.

Input Example

{"count":10,"offset":0}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
preview	boolean	Output field: preview
init_offset	number	Output field: init_offset
post_process_count	number	Count value
messages	array	Response message
messages.type	string	Type of the resource
messages.text	string	Response message
results	array	Result of the operation

Output Example

{"status_code":200,"response_headers":{"Date":"Wed, 04 Jun 2025 08:50:29 GMT","Expires":"Thu, 26 Oct 1978 00:00:00 GMT","Cache-Control":"no-store, no-cache, must-revalidate, max-age=0","Content-Type":"application/json; charset=UTF-8","X-Content-Type-Options":"nosniff","Link":"<../1749027018.39126>; rel=info","Content-Length":"166","Vary":"Cookie, Authorization","Connection":"Keep-Alive","X-Frame-Options":"SAMEORIGIN","Server":"Splunkd"},"reason":"OK","json_body":{"preview":false,"init_offset":0,...

Response Headers

Header	Description	Example
Cache-Control	Directives for caching mechanisms	no-store, no-cache, must-revalidate, max-age=0
Connection	HTTP response header: Connection	Keep-Alive
Content-Encoding	HTTP response header: Content-Encoding	gzip
Content-Length	The length of the response body in bytes	166
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT
Expires	The date/time after which the response is considered stale	Thu, 26 Oct 1978 00:00:00 GMT
Link	HTTP response header: Link	<../1749027018.39126>; rel=info
Server	Information about the software used by the origin server	Splunkd
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
Vary	HTTP response header: Vary	Accept-Encoding, Cookie, Authorization
X-Content-Type-Options	HTTP response header: X-Content-Type-Options	nosniff
X-Frame-Options	HTTP response header: X-Frame-Options	SAMEORIGIN