Turn Machine Data Into Answers. Splunk delivers real-time answers and business value from machine data so you can make better decisions.

Connect Splunk with LogicHub

1. Navigate to Automations > Integrations.
2. Search for Splunk.
3. Click Details, then the + icon. Enter the required information in the following fields.
   • Label: Enter a connection name.
   • Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.
   • Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).
   • Remote Agent: Run this integration using the LogicHub Remote Agent.
   • URL: URL of the Splunk server (e.g., https://www.example.com)
   • User: User name to log in with.
   • Password: Password to log in with.
   • CA Certificate: Upload a .crt CA Certificate file.
4. After you've entered all the details, click Connect.

Actions for Splunk

Update Notables

Update the status, urgency, owner, or comment of one or more notable events.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing results of performing the action.

Query (Deprecated)

Runs query on Splunk

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing results of performing the action.

Query

Runs query on Splunk

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

{
   "Workload":"OneDrive",
   "Id":"asdfasdf-asdf-as-df-sd8dbasdf53",
   "EventSource":"SharePoint",
   "ListId":"asdf-8c39-40a8-bd29-asdf",
   "SiteUrl":"https://test.sharepoint.com/personal/test/",
   "CreationTime":"2023-04-03T05:59:59"
}

List Users

Lists Splunk users

Input Field

No Required Input

Output of Action:
A JSON object containing multiple rows of result of Splunk user details.

Restart Splunk

Restarts Splunk Web interface and/or splunkd server daemon.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing results of performing the action.

Reset User Password

Resets given user's password

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing results of performing the action.

Configure Replication Factor

Configures replication and Search factor. Requires a restart of splunkd server daemon.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing results of performing the action.

Forward to Splunk index

It writes to a particular Splunk index.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

{
   "result":"Successfully forwarded to splunk index",
   "error":null,
   "has_error":false
}

Release Notes

• v5.1.0 - Added new Query action with performance improvement and no result limit.
• v5.0.0 - Updated architecture to support IO via filesystem
• v4.4.0 - Added optional field CA Certificate at connection level to override the default certificate.
• v4.3.1 - Added new optional fields: app name and user name search to a specific app within a Splunk server in Query action.
• v4.2.0 - Added new optional field source in an existing action Forward to Splunk Index.