> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coreflux.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Splunk Enterprise and Cloud

> Client-mode REST API connector for a curated Splunk Enterprise/Cloud slice: HEC JSON and raw ingest, HEC health, and search job create/results

Technical Preview

## Overview

A client-mode connector for a **curated observability / ITSM** slice of the Splunk [HTTP Event Collector](https://help.splunk.com/en/splunk-enterprise/get-data-in/collect-http-event-data/http-event-collector-rest-api-endpoints) and [search jobs REST API](https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-tutorials/10.4/rest-api-tutorials/creating-searches-using-the-rest-api):

| Catalog connector event | Entity / path | Notes |
| - | - | - |
| GET collector health (helper) | `GET /services/collector/health` | Typically **unauthenticated**; HEC healthy payload |
| POST collector/event | `POST /services/collector/event` | `Authorization: Splunk <hec_token>`; JSON envelope (`event` required) |
| POST collector/raw | `POST /services/collector/raw` | Splunk token; `text/plain`; channel GUID when indexer ack enabled |
| POST search/jobs | `POST /services/search/jobs` | Management **:8089**; form-urlencoded `search=` + `output_mode=json` |
| GET search/jobs/\{sid}/results | `GET /services/search/jobs/{sid}/results` | Management **:8089**; results only when job `DONE` |

Default `BASE_ADDRESS` is `https://splunk.example.com:8088` (HEC). Topics use `itsm/splunk/<object>/<verb>`.

> [!NOTE]
>
> **Ports:** HEC defaults to **:8088**; management REST (search jobs) defaults to **:8089**. Keep HEC as primary BASE. For CreateSearchJob / GetSearchResults, point BASE at the management host (or deploy a second connector copy). Splunk Cloud HEC often uses `https://http-inputs-&lt;host&gt;.splunkcloud.com:8088`. Do not put a trailing slash on `BASE_ADDRESS`.

> [!NOTE]
>
> Prefer Hub secrets for the HEC token (`Authorization: Splunk …`). Search jobs need management Basic or Bearer credentials. Status remains blocked until an authenticated HEC write (or owned-instance smoke) succeeds — public docs probes alone are not enough.

## Basic Syntax

```lot wrap theme={"theme":"css-variables","languages":{"custom":["/languages/lot.json"]}}
# Coreflux REST_API template — Splunk Enterprise and Cloud (HEC + search curated slice)
# Auth HEC: Authorization: Splunk {value.json.hec_token}
# Auth search: Authorization: Bearer {value.json.token} (or Basic)
# BASE_ADDRESS: https://splunk.example.com:8088  (HEC; use :8089 for search)
# GetCollectorHealth: no Authorization header

DEFINE ROUTE SplunkRestApi WITH TYPE REST_API
    ADD REST_API_CONFIG
        WITH BASE_ADDRESS "https://splunk.example.com:8088"
        WITH ENABLE_CLIENT "true"
        WITH USE_SSL "true"
        WITH REQUEST_TIMEOUT '60'
        WITH DEFAULT_CONTENT_TYPE "application/json"
    ADD EVENT Getcollectorhealth
        WITH SOURCE_TOPIC "itsm/splunk/collector/health"
        WITH DESTINATION_TOPIC "itsm/splunk/collector/health/response"
        WITH METHOD "GET"
        WITH ENDPOINT "/services/collector/health"
        WITH HEADERS
            ADD "Accept" "application/json"
    ADD EVENT Postcollectorevent
        WITH SOURCE_TOPIC "itsm/splunk/collector/event"
        WITH DESTINATION_TOPIC "itsm/splunk/collector/event/response"
        WITH METHOD "POST"
        WITH ENDPOINT "/services/collector/event"
        WITH HEADERS
            ADD "Accept" "application/json"
            ADD "Content-Type" "application/json"
            ADD "Authorization" "Splunk {value.json.hec_token}"
        WITH BODY "{payload}"
    ADD EVENT Postcollectorraw
        WITH SOURCE_TOPIC "itsm/splunk/collector/raw"
        WITH DESTINATION_TOPIC "itsm/splunk/collector/raw/response"
        WITH METHOD "POST"
        WITH ENDPOINT "/services/collector/raw?channel={value.json.channel}&sourcetype={value.json.sourcetype}"
        WITH HEADERS
            ADD "Accept" "application/json"
            ADD "Content-Type" "text/plain"
            ADD "Authorization" "Splunk {value.json.hec_token}"
            ADD "X-Splunk-Request-Channel" "{value.json.channel}"
        WITH BODY "{payload}"
    ADD EVENT Createsearchjob
        WITH SOURCE_TOPIC "itsm/splunk/search/jobs/create"
        WITH DESTINATION_TOPIC "itsm/splunk/search/jobs/create/response"
        WITH METHOD "POST"
        WITH ENDPOINT "/services/search/jobs"
        WITH HEADERS
            ADD "Accept" "application/json"
            ADD "Content-Type" "application/x-www-form-urlencoded"
            ADD "Authorization" "Bearer {value.json.token}"
        WITH BODY "{payload}"
    ADD EVENT Getsearchresults
        WITH SOURCE_TOPIC "itsm/splunk/search/jobs/results"
        WITH DESTINATION_TOPIC "itsm/splunk/search/jobs/results/response"
        WITH METHOD "GET"
        WITH ENDPOINT "/services/search/jobs/{value.json.sid}/results?output_mode={value.json.output_mode}"
        WITH HEADERS
            ADD "Accept" "application/json"
            ADD "Authorization" "Bearer {value.json.token}"
```

## Events

| Event | Method | Endpoint | Request topic | Response topic |
| - | - | - | - | - |
| Getcollectorhealth | GET | `/services/collector/health` | `itsm/splunk/collector/health` | `itsm/splunk/collector/health/response` |
| Postcollectorevent | POST | `/services/collector/event` | `itsm/splunk/collector/event` | `itsm/splunk/collector/event/response` |
| Postcollectorraw | POST | `/services/collector/raw?channel=&sourcetype=` | `itsm/splunk/collector/raw` | `itsm/splunk/collector/raw/response` |
| Createsearchjob | POST | `/services/search/jobs` | `itsm/splunk/search/jobs/create` | `itsm/splunk/search/jobs/create/response` |
| Getsearchresults | GET | `/services/search/jobs/{sid}/results?output_mode=` | `itsm/splunk/search/jobs/results` | `itsm/splunk/search/jobs/results/response` |

## Auth

**HEC token (preferred for event/raw):**

1. Create an [HTTP Event Collector](https://help.splunk.com/en/splunk-enterprise/get-data-in/collect-http-event-data/format-events-for-http-event-collector) token in Splunk Web or via REST.
2. Set connector `BASE_ADDRESS` to your HEC host (`:8088` or Cloud ingest URL; no trailing slash).
3. Pass `hec_token` on the MQTT request payload so headers resolve:
   * `Authorization: Splunk {value.json.hec_token}`
4. Store the token in Hub secrets / `GET SECRET "SPLUNK_HEC_TOKEN"`. Never commit real credentials.

**HEC Basic (alternative):** username any string, password = HEC token — configure `WITH USERNAME` / `WITH PASSWORD GET SECRET "SPLUNK_HEC_TOKEN"` and drop Splunk Authorization headers.

**Management / search (`:8089`):**

1. Point `BASE_ADDRESS` at the management port (or a second connector copy).
2. Use `Authorization: Bearer {value.json.token}` **or** Basic `WITH USERNAME` / `WITH PASSWORD GET SECRET "SPLUNK_PASSWORD"`.

**GetCollectorHealth:** omit Authorization — most installs expose HEC health without a token.

## Example payloads

**Health:**

```json theme={"theme":"css-variables","languages":{"custom":["/languages/lot.json"]}}
{}
```

**Post JSON event from alarm:**

```json theme={"theme":"css-variables","languages":{"custom":["/languages/lot.json"]}}
{
  "hec_token": "YOUR_HEC_TOKEN",
  "event": "Vibration above threshold — Zone A",
  "sourcetype": "coreflux:iot",
  "source": "coreflux",
  "fields": { "zone": "A", "metric": "vibration" }
}
```

**Post raw:**

```json theme={"theme":"css-variables","languages":{"custom":["/languages/lot.json"]}}
{
  "hec_token": "YOUR_HEC_TOKEN",
  "channel": "00872DC6-AC83-4EDE-8AFE-8413C3825C4C",
  "sourcetype": "coreflux:raw"
}
```

Body is the raw text (`{payload}`). Include `channel` when indexer acknowledgement is enabled.

**Create search job** (BASE = management `:8089`):

```json theme={"theme":"css-variables","languages":{"custom":["/languages/lot.json"]}}
{
  "token": "YOUR_BEARER_OR_SESSION_TOKEN",
  "payload": "search=search%20index%3Dmain%20earliest%3D-15m%20%7C%20head%2010&output_mode=json"
}
```

**Get search results:**

```json theme={"theme":"css-variables","languages":{"custom":["/languages/lot.json"]}}
{
  "token": "YOUR_BEARER_OR_SESSION_TOKEN",
  "sid": "1728000000.12",
  "output_mode": "json"
}
```

## Deploy notes

* Deploy **`SplunkRestApi.lot` only** (`-addRoute`). Do **not** deploy `hub-metadata.lot` as a connector — it exists for Hub / `-listTemplates` (`ADD METADATA` + `WITH IMAGE` base64).
* Hub category: **REST API Connectors**.
* Doc link: [https://docs.coreflux.org/latest/lot-language/routes/rest-api-apps/splunk-enterprise-and-cloud](https://docs.coreflux.org/latest/lot-language/routes/rest-api-apps/splunk-enterprise-and-cloud)

## Related

* [REST API Connectors](/latest/lot-language/routes/rest-api-routes)
* [REST API Apps catalog](/latest/lot-language/routes/rest-api-apps)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.