Splunk

Entities, operations, and actions

All the Integration Connectors provide a layer of abstraction for the objects of the connected application. You can access an application's objects only through this abstraction. The abstraction is exposed to you as entities, operations, and actions.

• Entity: An entity can be thought of as an object, or a collection of properties, in the connected application or service. The definition of an entity differs from a connector to a connector. For example, in a database connector, tables are the entities, in a file server connector, folders are the entities, and in a messaging system connector, queues are the entities.

  However, it is possible that a connector doesn't support or have any entities, in which case the Entities list will be empty.

• Operation: An operation is the activity that you can perform on an entity. You can perform any of the following operations on an entity:
  • List
  • Get
  • Create
  • Update
  • Delete

  Selecting an entity from the available list, generates a list of operations available for the entity. For a detailed description of the operations, see the Connectors task's entity operations. However, if a connector doesn't support any of the entity operations, such unsupported operations aren't listed in the Operations list.

• Action: An action is a first class function that is made available to the integration through the connector interface. An action lets you make changes to an entity or entities, and vary from connector to connector. Normally, an action will have some input parameters, and an output parameter. However, it is possible that a connector doesn't support any action, in which case the Actions list will be empty.

Actions

This section lists the actions supported by the connector. To understand how to configure the actions, see Action examples.

CreateHTTPEvent action

This action lets you send data and application events to a Splunk deployment over the HTTP and HTTPS protocols.

Input parameters of the CreateHTTPEvent action

Output parameters of the CreateHTTPEvent action

This action returns the success status of the created event.

CreateIndex action

This action lets you create indexes.

Input parameters of the CreateIndex action

Output parameters of the CreateIndex action

This action returns confirmation message of the CreateIndex action.

For example on how to configure the CreateIndex action, see Action examples.

CreateSavedSearch action

This action let you save your searches

Input parameters of the CreateSavedSearch action

Output parameters of the CreateSavedSearch action

This action returns confirmation message of the CreateSavedSearch action.

For example on how to configure the CreateSavedSearch action, see Action examples.

UpdateSavedSearch action

This action lets you update a saved search.

Input parameters of the UpdateSavedSearch action

Output parameters of the UpdateSavedSearch action

This action returns confirmation message of the UpdateSavedSearch action.

For example on how to configure the UpdateSavedSearch action, see Action examples.

DeleteIndex action

This action lets you delete an index.

Input parameters of the DeleteIndex action

Output parameters of the DeleteIndex action

This action returns confirmation message of the DeleteIndex action

For example on how to configure the DeleteIndex action, see Action examples.

UpdateIndex action

This action lets you update an index.

Input parameters of the UpdateIndex action

Output parameters of the UpdateIndex action

This action returns confirmation message of the UpdateIndex action.

For example on how to configure the UpdateIndex action, see Action examples.

Action examples

Example - Create a HTTP event

This example creates a HTTP event.

1. In the Configure connector task dialog, click Actions.
2. Select the CreateHTTPEvent action, and then click Done.
3. In the Task Input section of the Connectors task, click connectorInputPayload and then enter a value similar to the following in the Default Value field:

   {
   "EventContent": "Testing Task",
   "ContentType": "RAWTEXT",
   "ChannelGUID": "ContentType=RAWTEXT"
   }

If the action is successful, the CreateHTTPEvent task's connectorOutputPayload response parameter will have a value similar to the following:

[{
"Success": "Success"
}] 

Example - Create an index

This example creates an index.

1. In the Configure connector task dialog, click Actions.
2. Select the CreateIndex action, and then click Done.
3. In the Task Input section of the Connectors task, click connectorInputPayload and then enter a value similar to the following in the Default Value field:

   {
   "Name": "http_testing"
   }

If the action is successful, the CreateIndex task's connectorOutputPayload response parameter will have a value similar to the following:

[{
"AssureUTF8": null,
"BlockSignSize": null,
"BlockSignatureDatabase": null,
"BucketRebuildMemoryHint": null,
"ColdPath": null,
"FrozenTimePeriodInSecs": null,
"HomePath": null,
"HomePathExpanded": null,
"IndexThreads": null,
"IsInternal": null,
"MaxConcurrentOptimizes": null,
"MaxDataSize": null,
"MaxHotBuckets": null,
"SuppressBannerList": null,
"Sync": null,
"SyncMeta": null,
"ThawedPath": null,
"ThawedPathExpanded": null,
"TstatsHomePath": null,
"WarmToColdScript": null,
}]

Example - Create a saved search

This example creates a saved search.

1. In the Configure connector task dialog, click Actions.
2. Select the CreateSavedSearch action, and then click Done.
3. In the Task Input section of the Connectors task, click connectorInputPayload and then enter a value similar to the following in the Default Value field:

   {
   "Name": "test_created_g",
   "Search": "index=\"http_testing\"",
   "CronSchedule": "*/1 * * * *",
   "IsVisible": true,
   "RealTimeSchedule": true,
   "RunOnStartup": true,
   "IsScheduled": true,
   "SchedulePriority": "highest",
   "UserContext": "nobody"
   }

If the action is successful, the CreateSavedSearch task's connectorOutputPayload response parameter will have a value similar to the following:

[{
"Success": true,
"Message": null
}]

Example - Update a saved search

This example updates a saved search.

1. In the Configure connector task dialog, click Actions.
2. Select the UpdateSavedSearch action, and then click Done.
3. In the Task Input section of the Connectors task, click connectorInputPayload and then enter a value similar to the following in the Default Value field:

   {
   "Name": "test_created_g",
   "Search": "index=\"december_test_data\"",
   "CronSchedule": "*/1 * * * *",
   "IsVisible": true,
   "RealTimeSchedule": true,
   "RunOnStartup": true,
   "IsScheduled": true,
   "SchedulePriority": "highest"
   }

If the action is successful, the UpdateSavedSearch task's connectorOutputPayload response parameter will have a value similar to the following:

[{
"Success": true,
"Message": null
}]

Example - Delete an index

This example deletes an index.

1. In the Configure connector task dialog, click Actions.
2. Select the DeleteIndex action, and then click Done.
3. In the Task Input section of the Connectors task, click connectorInputPayload and then enter a value similar to the following in the Default Value field:

   {
   "Name": "g_http_testing"
   }

If the action is successful, the DeleteIndex task's connectorOutputPayload response parameter will have a value similar to the following:

[{
"Success": true,
"ErrorCode": null,
"ErrorMessage": null
}]

Example - Update an index

This example updates an index.

1. In the Configure connector task dialog, click Actions.
2. Select the UpdateIndex action, and then click Done.
3. In the Task Input section of the Connectors task, click connectorInputPayload and then enter a value similar to the following in the Default Value field:

   {
   "MaxTotalDataSizeMB": "400000",
   "Name": "g_http_testing"
   }

If the action is successful, the UpdateIndex task's connectorOutputPayload response parameter will have a value similar to the following:

[{
"AssureUTF8": false,
"BlockSignSize": null,
"BlockSignatureDatabase": null,
"BucketRebuildMemoryHint": "auto",
"ColdPath": "$SPLUNK_DB\\g_http_testing\\colddb",
"ColdPathExpanded": "C:\\Program Files\\Splunk\\var\\lib\\splunk\\g_http_testing\\colddb",
"ColdToFrozenDir": "",
"ColdToFrozenScript": "",
"CurrentDBSizeMB": 1.0,
"DefaultDatabase": "main",
"EnableOnlineBucketRepair": true,
"EnableRealtimeSearch": true,
"FrozenTimePeriodInSecs": 1.886976E8,
"HomePath": "$SPLUNK_DB\\g_http_testing\\db",
"HomePathExpanded": "C:\\Program Files\\Splunk\\var\\lib\\splunk\\g_http_testing\\db",
"IndexThreads": "auto",
"IsInternal": false,
"LastInitTime": "2024-01-08 05:15:28.0",
"MaxBloomBackfillBucketAge": "30d",
"ThawedPath": "$SPLUNK_DB\\g_http_testing\\thaweddb",
"ThawedPathExpanded": "C:\\Program Files\\Splunk\\var\\lib\\splunk\\g_http_testing\\thaweddb",
"ThrottleCheckPeriod": 15.0,
"TotalEventCount": 0.0,
"TsidxDedupPostingsListMaxTermsLimit": 8388608.0,
"TstatsHomePath": "volume:_splunk_summaries\\$_index_name\\datamodel_summary",
"WarmToColdScript": "",
"Success": true,
"ErrorCode": null,
"ErrorMessage": null
}]

Entity operation examples

This section shows how to perform some of the entity operations in this connector.

Example - List all the records

This example lists all the records in the SearchJobs entity.

1. In the Configure connector task dialog, click Entities.
2. Select SearchJobs from the Entity list.
3. Select the List operation, and then click Done.
4. Optionally, in Task Input section of the Connectors task, you can filter your result set by specifying a filter clause. Specify the filter clause value always within the single quotes (').

Example - Get a record from an entity

This example gets a record with the specified ID from the SearchJobs entity.

1. In the Configure connector task dialog, click Entities.
2. Select SearchJobs from the Entity list.
3. Select the Get operation, and then click Done.
4. In the Task Input section of the Connectors task, click EntityId and then enter 1698309163.1300 in the Default Value field.

   Here, 1698309163.1300 is a unique record ID in the SearchJobs entity.

Example - Create a record in an entity

This example creates a record in the SearchJobs entity.

1. In the Configure connector task dialog, click Entities.
2. Select SearchJobs from the Entity list.
3. Select the Create operation, and then click Done.
4. In the Data Mapper section of the Data Mapping task, click Open Data Mapping Editor and then enter a value similar to the following in the Input Value field and choose the EntityId/ConnectorInputPayload as Local variable.

   { 
   "EventSearch": "search (index=\"antivirus_logs\") sourcetype=access_combined | rex  \"(?\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})\" | iplocation IP_address| table IP_address, City, Country" 
   } 
   

   If the integration is successful, the SearchJobs task's connectorOutputPayload response parameter will have a value similar to the following:

   {
   "Sid": "1699336785.1919"
   } 
   

Example - Create a record in an entity

This example creates a record in the DataModels entity.

1. In the Configure connector task dialog, click Entities.
2. Select DataModels from the Entity list.
3. Select the Create operation, and then click Done.
4. In the Task Input section of the Connectors task, click connectorInputPayload and then enter a value similar to the following in the Default Value field:

   {
   "Id": "Test1",
   "Acceleration": "{\"enabled\":false,\"earliest_time\":\"\",
   \"max_time\":3600,\"backfill_time\":\"\",\"source_guid\":\"\",
   \"manual_rebuilds\":false,\"poll_buckets_until_maxtime\":false,
   \"max_concurrent\":3,\"allow_skew\":\"0\",\"schedule_priority\":\"default\"
   ,\"allow_old_summaries\":false,\"hunk.file_format\":\"\",\"hunk.dfs_block_size\":0,
   \"hunk.compression_codec\":\"\",\"workload_pool\":\"\"}"
   }

   If the integration is successful, your connector task's connectorOutputPayload field will have a value similar to the following:

   [{
   "Id": "Test1"
   }]

Example - Delete a record from an entity

This example deletes the record with the specified ID in the DataModels entity.

1. In the Configure connector task dialog, click Entities.
2. Select DataModels from the Entity list.
3. Select the Delete operation, and then click Done.
4. In the Task Input section of the Connectors task, click entityId and then enter Test1 in the Default Value field.

Example - Update a record in an entity

This example updates a record in the DataModels entity.

1. In the Configure connector task dialog, click Entities.
2. Select DataModels from the Entity list.
3. Select the Update operation, and then click Done.
4. In the Task Input section of the Connectors task, click connectorInputPayload and then enter a value similar to the following in the Default Value field:

   {
   "Acceleration": "{\"enabled\":true,\"earliest_time\":\"-3mon\",
   \"cron_schedule\":\"*/5 * * * *\",\"max_time\":60,
   \"backfill_time\":\"\",\"source_guid\":\"\",\"manual_rebuilds\":false,
   \"poll_buckets_until_maxtime\":false,\"max_concurrent\":3,
   \"allow_skew\":\"0\",\"schedule_priority\":\"default\",
   \"allow_old_summaries\":false,\"hunk.file_format\":\"\",\"hunk.dfs_block_size\":0,
   \"hunk.compression_codec\":\"\",\"workload_pool\":\"\"}"
   }

5. Click entityId, and then enter /servicesNS/nobody/search/datamodel/model/Testing in the Default Value field.

   If the integration is successful, your connector task's connectorOutputPayload field will have a value similar to the following:

   [{
   "Id": "/servicesNS/nobody/search/datamodel/model/Testing"
   }]

Example - Search flow using index

This section lists all the search flow using single index and multiple indices.

Create a search using single Index

1. In the Configure connector task dialog, click Entities.
2. Select SearchJobs from the Entity list.
3. Select the Create operation, and then click Done.
4. In the Data Mapper section of the Data Mapping task, click Open Data Mapping Editor and then enter a value similar to the following in the Input Value field and choose the EntityId/ConnectorInputPayload as Local variable.

   {
   "EventSearch": "search (index=\"http_testing\" sourcetype=\"googlecloud-testing\") "
   }
   

   If the integration is successful, the SearchJobs task's connectorOutputPayload response parameter will have a value similar to the following:

   {
   "Sid": "1726051471.76"
   } 
   

List operation using the Index Name used in Search Query

1. In the Configure connector task dialog, click Entities.
2. Select Index Name from the Entity list.
3. Select the List operation, and then click Done.
4. Task Input section of the Connectors task, you can set the filterClause, such as Sid= '1726051471.76'.

If the integration is successful, the Index Name task's connectorOutputPayload response parameter will have a value similar to the following:

[{
  "_bkt": "http_testing~0~D043151E-5A2D-4FAB-8647-4D5DA2F288AF",
  "_cd": "00:04:00",
  "_eventtype_color": null,
  "_indextime": 1.720702012E9,
  "_kv": null,
  "_raw": "hi How r yo\nplease\nfind \nmy notes",
  "_serial": 0.0,
  "_si": "googlecloud-bcone-splunk-vm\nhttp_testing",
  "_sourcetype": "googlecloud-testing",
  "_time": "2024-07-11 12:46:52.0",
  "eventtype": null,
  "host": "googlecloud-bcone-splunk-vm",
  "index": "http_testing",
  "linecount": 4.0,
  "punct": null,
  "source": "Testing.txt",
  "sourcetype": "googlecloud-testing",
  "splunk_server": "googlecloud-bcone-splunk-vm",
  "splunk_server_group": null,
  "timestamp": null,
  "JobId": "1726051471.76"
}]

Create a search using multiple Indices

1. In the Configure connector task dialog, click Entities.
2. Select SearchJobs from the Entity list.
3. Select the Create operation, and then click Done.
4. In the Data Mapper section of the Data Mapping task, click Open Data Mapping Editor and then enter a value similar to the following in the Input Value field and choose the EntityId/ConnectorInputPayload as Local variable.

   {
   "EventSearch": "search (index=\"http_testing\" OR index= \"googlecloud-demo\" sourcetype=\"googlecloud-testing\"  OR sourcetype=\"Demo_Text\")"
   }
   

   If the integration is successful, the SearchJobs task's connectorOutputPayload response parameter will have a value similar to the following:

   {
   "Sid": "1727261971.4007"
   } 
   

List operation using the Indices Name used in Search Query

1. In the Configure connector task dialog, click Entities.
2. Select Index Name Name from the Entity list.
3. Select the List operation, and then click Done.
4. Task Input section of the Connectors task, you can set the filterClause, such as Sid= '1727261971.4007'.

If the integration is successful, the Index task's connectorOutputPayload response parameter will have a value similar to the following:

 [{
  "_bkt": "googlecloud-demo~0~D043151E-5A2D-4FAB-8647-4D5DA2F288AF",
  "_cd": "00:04:00",
  "_eventtype_color": null,
  "_indextime": 1.727155516E9,
  "_kv": null,
  "_raw": "Hi team\nwe have a demo please plan accordingly\nwith Google team",
  "_serial": 0.0,
  "_si": "googlecloud-bcone-splunk-vm\ngooglecloud-demo",
  "_sourcetype": "Demo_Text",
  "_time": "2024-09-24 05:25:16.0",
  "eventtype": null,
  "host": "googlecloud-bcone-splunk-vm",
  "index": "googlecloud-demo",
  "linecount": 3.0,
  "punct": null,
  "source": "Splunk_Demo.txt",
  "sourcetype": "Demo_Text",
  "splunk_server": "googlecloud-bcone-splunk-vm",
  "splunk_server_group": null,
  "timestamp": null,
  "JobId": "1727261971.4007"
}, {
  "_bkt": "http_testing~0~D043151E-5A2D-4FAB-8647-4D5DA2F288AF",
  "_cd": "00:04:00",
  "_eventtype_color": null,
  "_indextime": 1.720702012E9,
  "_kv": null,
  "_raw": "hi How r yo\nplease\nfind \nmy notes",
  "_serial": 1.0,
  "_si": "googlecloud-bcone-splunk-vm\nhttp_testing",
  "_sourcetype": "googlecloud-testing",
  "_time": "2024-07-11 12:46:52.0",
  "eventtype": null,
  "host": "googlecloud-bcone-splunk-vm",
  "index": "http_testing",
  "linecount": 4.0,
  "punct": null,
  "source": "Testing.txt",
  "sourcetype": "googlecloud-testing",
  "splunk_server": "googlecloud-bcone-splunk-vm",
  "splunk_server_group": null,
  "timestamp": null,
  "JobId": "1727261971.4007"
}]

Example - Search flow using ReadJobResults

This section lists all the search flows that uses both single index and multiple indices supported by the Splunk connection. As of now,the maximum payload size for supported log results is 150MB.

Create a search with single index

1. In the Configure connector task dialog, click Entities.
2. Select SearchJobs from the Entity list.
3. Select the Create operation, and then click Done.
4. In the Data Mapper section of the Data Mapping task, click Open Data Mapping Editor and then enter a value similar to the following in the Input Value field and choose the EntityId/ConnectorInputPayload as Local variable.

   {
   "EventSearch": "search (index=\"http_testing\" sourcetype=\"googlecloud-testing\") "
   }
   

   This example creates a search If the integration is successful, the SearchJobs task's connectorOutputPayload response parameter will have a value similar to the following:

   {
   "Sid": "1732775755.24612"
   } 
   

To obtain the search results, perform the create operation on the ReadJobResults action. To ensure that the results are filtered based on the Sid, pass the Sid as a parameter to the action.

Get result logs using ReadJobResults action

1. In the Configure connector task dialog, click Actions.
2. Select the ReadJobResults action, and then click Done.
3. In the Data Mapper section of the Data Mapping task, click Open Data Mapping Editor and then enter a value similar to the following in the Input Value field and choose the EntityId/ConnectorInputPayload as Local variable.

   {
   "Sid": "1732775755.24612"
   }
   

If the action is successful, the ReadJobResults task's connectorOutputPayload response parameter will have a value similar to the following:

[{
"_bkt": "http_testing~0~D043151E-5A2D-4FAB-8647-4D5DA2F288AF",
"_cd": "0:4",
"_indextime": "1720702012",
"_raw": "hi How r yo\nplease\nfind \nmy notes",
"_serial": "1",
"_si": "googlecloud-bcone-splunk-vm\nhttp_testing",
"_sourcetype": "googlecloud-testing",
"_time": "2024-07-11T12:46:52.000+00:00",
"host": "googlecloud-bcone-splunk-vm",
"index": "http_testing",
"linecount": "4",
"source": "Testing.txt",
"sourcetype": "googlecloud-testing",
"splunk_server": "googlecloud-bcone-splunk-vm",
"jobid": "1732775755.24612",
"sid": "1732775755.24612"
}]

Create a search with multiple indices

1. In the Configure connector task dialog, click Entities.
2. Select SearchJobs from the Entity list.
3. Select the Create operation, and then click Done.
4. In the Data Mapper section of the Data Mapping task, click Open Data Mapping Editor and then enter a value similar to the following in the Input Value field and choose the EntityId/ConnectorInputPayload as Local variable.

   {
   "EventSearch": "search (index=\"http_testing\" OR index= \"googlecloud-demo\" sourcetype=\"googlecloud-testing\"  OR sourcetype=\"Demo_Text\")"
   }
   

   If the integration is successful, the SearchJobs task's connectorOutputPayload response parameter will have a value similar to the following:

   {
   "Sid": "1732776556.24634"
   } 
   

To obtain the search results, perform the create operation on the ReadJobResults action. To ensure that the results are filtered based on the Sid, pass the Sid as a parameter to the action.

ResultsLogs using ReadJobResults Action

1. In the Configure connector task dialog, click Actions.
2. Select the ReadJobResults action, and then click Done.
3. In the Data Mapper section of the Data Mapping task, click Open Data Mapping Editor and then enter a value similar to the following in the Input Value field and choose the EntityId/ConnectorInputPayload as Local variable.

   {
   "Sid": "1732776556.24634"
   }
   

If the action is successful, the ReadJobResults task's connectorOutputPayload response parameter will have a value similar to the following:

[{
"_bkt": "googlecloud-demo~0~D043151E-5A2D-4FAB-8647-4D5DA2F288AF",
"_cd": "0:4",
"_indextime": "1727155516",
"_raw": "Hi team\nwe have a demo please plan accordingly\nwith Google team",
"_serial": "0",
"_si": "googlecloud-bcone-splunk-vm\googlecloud-demo",
"_sourcetype": "Demo_Text",
"_time": "2024-09-24T05:25:16.000+00:00",
"host": "googlecloud-bcone-splunk-vm",
"index": "googlecloud-demo",
"linecount": "3",
"source": "Splunk_Demo.txt",
"sourcetype": "Demo_Text",
"splunk_server": "googlecloud-bcone-splunk-vm",
"jobid": "1732776556.24634",
"sid": "1732776556.24634"
},{
"_bkt": "http_testing~0~D043151E-5A2D-4FAB-8647-4D5DA2F288AF",
"_cd": "0:4",
"_indextime": "1720702012",
"_raw": "hi How r yo\nplease\nfind \nmy notes",
"_serial": "1",
"_si": "googlecloud-bcone-splunk-vm\nhttp_testing",
"_sourcetype": "googlecloud-testing",
"_time": "2024-07-11T12:46:52.000+00:00",
"host": "googlecloud-bcone-splunk-vm",
"index": "http_testing",
"linecount": "4",
"source": "Testing.txt",
"sourcetype": "googlecloud-testing",
"splunk_server": "googlecloud-bcone-splunk-vm",
"jobid": "1732776556.24634",
"sid": "1732776556.24634"
}]

Use terraform to create connections

You can use the Terraform resource to create a new connection.

To learn how to apply or remove a Terraform configuration, see Basic Terraform commands.

To view a sample terraform template for connection creation, see sample template.

When creating this connection by using Terraform, you must set the following variables in your Terraform configuration file:

Parameter name	Data type	Required	Description
verbosity	STRING	False	Verbosity level for connection, varies from 1-5. Higher verbosity level will log all the communication details (request,response & ssl certificates).
proxy_enabled	BOOLEAN	False	Select this checkbox to configure a proxy server for the connection.
proxy_auth_scheme	ENUM	False	The authentication type to use to authenticate to the ProxyServer proxy. Supported values are: BASIC, DIGEST, NONE
proxy_user	STRING	False	A user name to be used to authenticate to the ProxyServer proxy.
proxy_password	SECRET	False	A password to be used to authenticate to the ProxyServer proxy.
proxy_ssltype	ENUM	False	The SSL type to use when connecting to the ProxyServer proxy. Supported values are: AUTO, ALWAYS, NEVER, TUNNEL

Use the Splunk connection in an integration

After you create the connection, it becomes available in both Apigee Integration and Application Integration. You can use the connection in an integration through the Connectors task.

• To understand how to create and use the Connectors task in Apigee Integration, see Connectors task.
• To understand how to create and use the Connectors task in Application Integration, see Connectors task.

Get help from the Google Cloud community

You can post your questions and discuss this connector in the Google Cloud community at Cloud Forums.

What's next

• Understand how to suspend and resume a connection.
• Understand how to monitor connector usage.
• Understand how to view connector logs.