Splunk

Search, index, and analyze machine data with the Splunk REST API.

Detail	Value
Category	Monitoring
Base URL	https://splunk.example.com:8089
Authentication	Bearer Token
Endpoints	8
Connector key	splunk

Using Splunk in a workflow

1. Go to Connections and click New Connection.
2. Pick Splunk from the marketplace.
3. Enter your credentials (see Authentication above for what's expected).
4. In a workflow, drop an API Call node and select this connection.
5. Pick the operation you need from the Operation dropdown — the full list is below.

Available endpoints

Endpoint	Summary
POST /services/search/jobs	Create a search job
GET /services/search/jobs/{search_id}	Get search job status
GET /services/search/jobs/{search_id}/results	Get search results
POST /services/search/jobs/oneshot	Run oneshot search
POST /services/receivers/simple	Index an event
GET /services/data/indexes	List indexes
GET /services/saved/searches	List saved searches
GET /services/server/info	Get server info

Each endpoint is documented in full below. Use the outline on the right to jump to one.

POST /services/search/jobs

Create a search job

Detail	Value
Operation ID	monitoring.createSearchJob
Method	POST
Path	/services/search/jobs

Parameters

No parameters.

Using this endpoint in a workflow

1. Add an API Call node to your workflow.
2. Pick your Splunk connection from the Connection dropdown.
3. In the Operation dropdown, select monitoring.createSearchJob.
4. Fill in the parameter fields that appear. Use {{...}} to reference upstream values.

What it returns

The API Call node writes the response to the workflow context:

{
  status: 200,
  success: true,
  data: { ...response body from the API... },
  latencyMs: 142
}

Reference response fields downstream as {{nodeId.data.path}}. The exact response shape is documented on the upstream Splunk API reference.

GET /services/search/jobs/{search_id}

Get search job status

Detail	Value
Operation ID	monitoring.getSearchJob
Method	GET
Path	/services/search/jobs/{search_id}

Parameters

No parameters.

Using this endpoint in a workflow

1. Add an API Call node to your workflow.
2. Pick your Splunk connection from the Connection dropdown.
3. In the Operation dropdown, select monitoring.getSearchJob.
4. Fill in the parameter fields that appear. Use {{...}} to reference upstream values.

What it returns

The API Call node writes the response to the workflow context:

{
  status: 200,
  success: true,
  data: { ...response body from the API... },
  latencyMs: 142
}

Reference response fields downstream as {{nodeId.data.path}}. The exact response shape is documented on the upstream Splunk API reference.

GET /services/search/jobs/{search_id}/results

Get search results

Detail	Value
Operation ID	monitoring.getSearchResults
Method	GET
Path	/services/search/jobs/{search_id}/results

Parameters

No parameters.

Using this endpoint in a workflow

1. Add an API Call node to your workflow.
2. Pick your Splunk connection from the Connection dropdown.
3. In the Operation dropdown, select monitoring.getSearchResults.
4. Fill in the parameter fields that appear. Use {{...}} to reference upstream values.

What it returns

The API Call node writes the response to the workflow context:

{
  status: 200,
  success: true,
  data: { ...response body from the API... },
  latencyMs: 142
}

Reference response fields downstream as {{nodeId.data.path}}. The exact response shape is documented on the upstream Splunk API reference.

POST /services/search/jobs/oneshot

Run oneshot search

Detail	Value
Operation ID	monitoring.oneshotSearch
Method	POST
Path	/services/search/jobs/oneshot

Parameters

No parameters.

Using this endpoint in a workflow

1. Add an API Call node to your workflow.
2. Pick your Splunk connection from the Connection dropdown.
3. In the Operation dropdown, select monitoring.oneshotSearch.
4. Fill in the parameter fields that appear. Use {{...}} to reference upstream values.

What it returns

The API Call node writes the response to the workflow context:

{
  status: 200,
  success: true,
  data: { ...response body from the API... },
  latencyMs: 142
}

Reference response fields downstream as {{nodeId.data.path}}. The exact response shape is documented on the upstream Splunk API reference.

POST /services/receivers/simple

Index an event

Detail	Value
Operation ID	monitoring.indexEvent
Method	POST
Path	/services/receivers/simple

Parameters

No parameters.

Using this endpoint in a workflow

1. Add an API Call node to your workflow.
2. Pick your Splunk connection from the Connection dropdown.
3. In the Operation dropdown, select monitoring.indexEvent.
4. Fill in the parameter fields that appear. Use {{...}} to reference upstream values.

What it returns

The API Call node writes the response to the workflow context:

{
  status: 200,
  success: true,
  data: { ...response body from the API... },
  latencyMs: 142
}

Reference response fields downstream as {{nodeId.data.path}}. The exact response shape is documented on the upstream Splunk API reference.

GET /services/data/indexes

List indexes

Detail	Value
Operation ID	monitoring.listIndexes
Method	GET
Path	/services/data/indexes

Parameters

No parameters.

Using this endpoint in a workflow

1. Add an API Call node to your workflow.
2. Pick your Splunk connection from the Connection dropdown.
3. In the Operation dropdown, select monitoring.listIndexes.
4. Fill in the parameter fields that appear. Use {{...}} to reference upstream values.

What it returns

The API Call node writes the response to the workflow context:

{
  status: 200,
  success: true,
  data: { ...response body from the API... },
  latencyMs: 142
}

Reference response fields downstream as {{nodeId.data.path}}. The exact response shape is documented on the upstream Splunk API reference.

GET /services/saved/searches

List saved searches

Detail	Value
Operation ID	monitoring.listSavedSearches
Method	GET
Path	/services/saved/searches

Parameters

No parameters.

Using this endpoint in a workflow

1. Add an API Call node to your workflow.
2. Pick your Splunk connection from the Connection dropdown.
3. In the Operation dropdown, select monitoring.listSavedSearches.
4. Fill in the parameter fields that appear. Use {{...}} to reference upstream values.

What it returns

The API Call node writes the response to the workflow context:

{
  status: 200,
  success: true,
  data: { ...response body from the API... },
  latencyMs: 142
}

Reference response fields downstream as {{nodeId.data.path}}. The exact response shape is documented on the upstream Splunk API reference.

GET /services/server/info

Get server info

Detail	Value
Operation ID	monitoring.getServerInfo
Method	GET
Path	/services/server/info

Parameters

No parameters.

Using this endpoint in a workflow

1. Add an API Call node to your workflow.
2. Pick your Splunk connection from the Connection dropdown.
3. In the Operation dropdown, select monitoring.getServerInfo.
4. Fill in the parameter fields that appear. Use {{...}} to reference upstream values.

What it returns

The API Call node writes the response to the workflow context:

{
  status: 200,
  success: true,
  data: { ...response body from the API... },
  latencyMs: 142
}

Reference response fields downstream as {{nodeId.data.path}}. The exact response shape is documented on the upstream Splunk API reference.