Splunk Enterprise and Cloud

Technical Preview

Overview

A client-mode connector for a curated observability / ITSM slice of the Splunk HTTP Event Collector and search jobs REST API:

Catalog connector event	Entity / path	Notes
GET collector health (helper)	`GET /services/collector/health`	Typically unauthenticated; HEC healthy payload
POST collector/event	`POST /services/collector/event`	`Authorization: Splunk <hec_token>`; JSON envelope (`event` required)
POST collector/raw	`POST /services/collector/raw`	Splunk token; `text/plain`; channel GUID when indexer ack enabled
POST search/jobs	`POST /services/search/jobs`	Management :8089; form-urlencoded `search=` + `output_mode=json`
GET search/jobs/{sid}/results	`GET /services/search/jobs/{sid}/results`	Management :8089; results only when job `DONE`

Default BASE_ADDRESS is https://splunk.example.com:8088 (HEC). Topics use itsm/splunk/<object>/<verb>.

Ports: HEC defaults to :8088; management REST (search jobs) defaults to :8089. Keep HEC as primary BASE. For CreateSearchJob / GetSearchResults, point BASE at the management host (or deploy a second connector copy). Splunk Cloud HEC often uses https://http-inputs-<host>.splunkcloud.com:8088. Do not put a trailing slash on BASE_ADDRESS.

Prefer Hub secrets for the HEC token (Authorization: Splunk …). Search jobs need management Basic or Bearer credentials. Status remains blocked until an authenticated HEC write (or owned-instance smoke) succeeds — public docs probes alone are not enough.

Basic Syntax

# Coreflux REST_API template — Splunk Enterprise and Cloud (HEC + search curated slice)
# Auth HEC: Authorization: Splunk {value.json.hec_token}
# Auth search: Authorization: Bearer {value.json.token} (or Basic)
# BASE_ADDRESS: https://splunk.example.com:8088  (HEC; use :8089 for search)
# GetCollectorHealth: no Authorization header

DEFINE ROUTE SplunkRestApi WITH TYPE REST_API
    ADD REST_API_CONFIG
        WITH BASE_ADDRESS "https://splunk.example.com:8088"
        WITH ENABLE_CLIENT "true"
        WITH USE_SSL "true"
        WITH REQUEST_TIMEOUT '60'
        WITH DEFAULT_CONTENT_TYPE "application/json"
    ADD EVENT Getcollectorhealth
        WITH SOURCE_TOPIC "itsm/splunk/collector/health"
        WITH DESTINATION_TOPIC "itsm/splunk/collector/health/response"
        WITH METHOD "GET"
        WITH ENDPOINT "/services/collector/health"
        WITH HEADERS
            ADD "Accept" "application/json"
    ADD EVENT Postcollectorevent
        WITH SOURCE_TOPIC "itsm/splunk/collector/event"
        WITH DESTINATION_TOPIC "itsm/splunk/collector/event/response"
        WITH METHOD "POST"
        WITH ENDPOINT "/services/collector/event"
        WITH HEADERS
            ADD "Accept" "application/json"
            ADD "Content-Type" "application/json"
            ADD "Authorization" "Splunk {value.json.hec_token}"
        WITH BODY "{payload}"
    ADD EVENT Postcollectorraw
        WITH SOURCE_TOPIC "itsm/splunk/collector/raw"
        WITH DESTINATION_TOPIC "itsm/splunk/collector/raw/response"
        WITH METHOD "POST"
        WITH ENDPOINT "/services/collector/raw?channel={value.json.channel}&sourcetype={value.json.sourcetype}"
        WITH HEADERS
            ADD "Accept" "application/json"
            ADD "Content-Type" "text/plain"
            ADD "Authorization" "Splunk {value.json.hec_token}"
            ADD "X-Splunk-Request-Channel" "{value.json.channel}"
        WITH BODY "{payload}"
    ADD EVENT Createsearchjob
        WITH SOURCE_TOPIC "itsm/splunk/search/jobs/create"
        WITH DESTINATION_TOPIC "itsm/splunk/search/jobs/create/response"
        WITH METHOD "POST"
        WITH ENDPOINT "/services/search/jobs"
        WITH HEADERS
            ADD "Accept" "application/json"
            ADD "Content-Type" "application/x-www-form-urlencoded"
            ADD "Authorization" "Bearer {value.json.token}"
        WITH BODY "{payload}"
    ADD EVENT Getsearchresults
        WITH SOURCE_TOPIC "itsm/splunk/search/jobs/results"
        WITH DESTINATION_TOPIC "itsm/splunk/search/jobs/results/response"
        WITH METHOD "GET"
        WITH ENDPOINT "/services/search/jobs/{value.json.sid}/results?output_mode={value.json.output_mode}"
        WITH HEADERS
            ADD "Accept" "application/json"
            ADD "Authorization" "Bearer {value.json.token}"

Events

Event	Method	Endpoint	Request topic	Response topic
Getcollectorhealth	GET	`/services/collector/health`	`itsm/splunk/collector/health`	`itsm/splunk/collector/health/response`
Postcollectorevent	POST	`/services/collector/event`	`itsm/splunk/collector/event`	`itsm/splunk/collector/event/response`
Postcollectorraw	POST	`/services/collector/raw?channel=&sourcetype=`	`itsm/splunk/collector/raw`	`itsm/splunk/collector/raw/response`
Createsearchjob	POST	`/services/search/jobs`	`itsm/splunk/search/jobs/create`	`itsm/splunk/search/jobs/create/response`
Getsearchresults	GET	`/services/search/jobs/{sid}/results?output_mode=`	`itsm/splunk/search/jobs/results`	`itsm/splunk/search/jobs/results/response`

Auth

HEC token (preferred for event/raw):

Create an HTTP Event Collector token in Splunk Web or via REST.
Set connector BASE_ADDRESS to your HEC host (:8088 or Cloud ingest URL; no trailing slash).
Pass hec_token on the MQTT request payload so headers resolve:
- Authorization: Splunk {value.json.hec_token}
Store the token in Hub secrets / GET SECRET "SPLUNK_HEC_TOKEN". Never commit real credentials.

HEC Basic (alternative): username any string, password = HEC token — configure WITH USERNAME / WITH PASSWORD GET SECRET "SPLUNK_HEC_TOKEN" and drop Splunk Authorization headers. Management / search (:8089):

Point BASE_ADDRESS at the management port (or a second connector copy).
Use Authorization: Bearer {value.json.token} or Basic WITH USERNAME / WITH PASSWORD GET SECRET "SPLUNK_PASSWORD".

GetCollectorHealth: omit Authorization — most installs expose HEC health without a token.

Example payloads

Health:

{}

Post JSON event from alarm:

{
  "hec_token": "YOUR_HEC_TOKEN",
  "event": "Vibration above threshold — Zone A",
  "sourcetype": "coreflux:iot",
  "source": "coreflux",
  "fields": { "zone": "A", "metric": "vibration" }
}

Post raw:

{
  "hec_token": "YOUR_HEC_TOKEN",
  "channel": "00872DC6-AC83-4EDE-8AFE-8413C3825C4C",
  "sourcetype": "coreflux:raw"
}

Body is the raw text ({payload}). Include channel when indexer acknowledgement is enabled. Create search job (BASE = management :8089):

{
  "token": "YOUR_BEARER_OR_SESSION_TOKEN",
  "payload": "search=search%20index%3Dmain%20earliest%3D-15m%20%7C%20head%2010&output_mode=json"
}

Get search results:

{
  "token": "YOUR_BEARER_OR_SESSION_TOKEN",
  "sid": "1728000000.12",
  "output_mode": "json"
}

Deploy notes

Deploy SplunkRestApi.lot only (-addRoute). Do not deploy hub-metadata.lot as a connector — it exists for Hub / -listTemplates (ADD METADATA + WITH IMAGE base64).
Hub category: REST API Connectors.
Doc link: https://docs.coreflux.org/latest/lot-language/routes/rest-api-apps/splunk-enterprise-and-cloud

Quick Start

Coreflux MQTT Broker

LoT Language

Coreflux HUB

VS Code - LoT Notebooks

Coreflux Portal

Using AI with Coreflux

Product Updates

Overview

Basic Syntax

Events

Auth

Example payloads

Deploy notes

​Overview

​Basic Syntax

​Events

​Auth

​Example payloads

​Deploy notes

​Related

Overview

Basic Syntax

Events

Auth

Example payloads

Deploy notes

Related