Splunk Integration

Run Splunk searches, manage saved searches and users, and send events via HEC. Automate Splunk deploys, issues, and webhook events across engineering workflows. When Watch Fired Alerts fires, automatically update documentation, notify a team, or continue with Get Alert Action.

Explore Documentation

3-day trialCancel anytimeUp to 10 minutes quick set up

GDPR
Data Encryption
2FA
Local Data Region

Supported triggers and actions for Splunk integration

Triggers can detect changes in Splunk and run actions that can create, search or modify data inside Splunk automatically [3] — exactly how you set them.

Watch Fired AlertsTriggers when matching fired alerts events occur.
Watch Search Job DoneTriggers when matching search job done events occur.
Get Alert ActionReturns the alert Action.
Get ConfigReturns the config.
Get Current ContextReturns the current Context.
Get Data ModelReturns the data Model.
Get Event TypeReturns the event Type.
Get Export Search ResultsReturns the export Search Results.
Get Field AliasReturns the field Alias.
Get Field ExtractionReturns the field Extraction.
Get Fired AlertReturns the fired Alert.
Get HEC HealthReturns the hEC Health.
Get HTTP InputReturns the hTTP Input.
Get IndexReturns the index.
Get KV Store CollectionReturns the kV Store Collection.
Get KV Store RecordReturns the kV Store Record.
Get Local AppReturns the local App.
Get LookupReturns the lookup.
Get MacroReturns the macro.
Get MessageReturns the message.
Get PanelReturns the panel.
Get Parsed SearchReturns the parsed Search.
Get RoleReturns the role.
Get Saved SearchReturns the saved Search.
Get Saved Search HistoryReturns the saved Search History.
Get Saved Search Scheduled TimesReturns the saved Search Scheduled Times.
Get Search JobReturns the search Job.
Get Search Job EventsReturns the search Job Events.
Get Search Job LogReturns the search Job Log.
Get Search Job ResultsReturns the search Job Results.
Get Search Job Results PreviewReturns the search Job Results Preview.
Get Search Job SummaryReturns the search Job Summary.
Get Search Job TimelineReturns the search Job Timeline.
Get Server InfoReturns the server Info.
Get TagReturns the tag.
Get TCP InputReturns the tCP Input.
Get TimeparserReturns the timeparser.
Get TokenReturns the token.
Get TransformReturns the transform.
Get UDP InputReturns the uDP Input.
Get UserReturns the user.
Get ViewReturns the view.
List Alert ActionsRetrieves a list of the alert Actions.
List CapabilitiesRetrieves a list of the capabilities.
List ConfigsRetrieves a list of the configs.
List Data ModelsRetrieves a list of the data Models.
List Event TypesRetrieves a list of the event Types.
List Field AliasesRetrieves a list of the field Aliases.
List Field ExtractionsRetrieves a list of the field Extractions.
List Fired AlertsRetrieves a list of the fired Alerts.
List HTTP InputsRetrieves a list of the hTTP Inputs.
List IndexesRetrieves a list of the indexes.
List InputsRetrieves a list of the inputs.
List KV Store CollectionsRetrieves a list of the kV Store Collections.
List KV Store RecordsRetrieves a list of the kV Store Records.
List Local AppsRetrieves a list of the local Apps.
List LookupsRetrieves a list of the lookups.
List MacrosRetrieves a list of the macros.
List MessagesRetrieves a list of the messages.
List Modular InputsRetrieves a list of the modular Inputs.
List PanelsRetrieves a list of the panels.
List RolesRetrieves a list of the roles.
List Saved SearchesRetrieves a list of the saved Searches.
List Saved Searches By NamespaceRetrieves a list of the saved Searches By Namespace.
List Search JobsRetrieves a list of the search Jobs.
List Search Jobs By NamespaceRetrieves a list of the search Jobs By Namespace.
List TagsRetrieves a list of the tags.
List TCP InputsRetrieves a list of the tCP Inputs.
List TokensRetrieves a list of the tokens.
List TransformsRetrieves a list of the transforms.
List UDP InputsRetrieves a list of the uDP Inputs.
List UsersRetrieves a list of the users.
List ViewsRetrieves a list of the views.
Search TypeaheadSearches the typeahead.
Acknowledge Saved SearchAcknowledges the saved Search.
Control Search JobControls the search Job.
Create Automatic LookupCreates the automatic Lookup.
Create Calculated FieldCreates the calculated Field.
Create Data ModelCreates the data Model.
Create Event TypeCreates the event Type.
Create Field AliasCreates the field Alias.
Create Field ExtractionCreates the field Extraction.
Create HTTP InputCreates the hTTP Input.
Create IndexCreates the index.
Create KV Store CollectionCreates the kV Store Collection.
Create KV Store RecordCreates the kV Store Record.
Create Local AppCreates the local App.
Create LookupCreates the lookup.
Create MacroCreates the macro.
Create MessageCreates the message.
Create PanelCreates the panel.
Create RoleCreates the role.
Create Saved SearchCreates the saved Search.
Create Search JobCreates the search Job.
Create TagCreates the tag.
Create TCP InputCreates the tCP Input.
Create TokenCreates the token.
Create TransformCreates the transform.
Create UDP InputCreates the uDP Input.
Create UserCreates the user.
Create ViewCreates the view.
Create Workflow ActionCreates the workflow Action.
Delete Event TypeDeletes the event Type.
Delete Fired AlertDeletes the fired Alert.
Delete HTTP InputDeletes the hTTP Input.
Delete IndexDeletes the index.
Delete KV Store CollectionDeletes the kV Store Collection.
Delete KV Store RecordDeletes the kV Store Record.
Delete Local AppDeletes the local App.
Delete LookupDeletes the lookup.
Delete MacroDeletes the macro.
Delete MessageDeletes the message.
Delete RoleDeletes the role.
Delete Saved SearchDeletes the saved Search.
Delete Search JobDeletes the search Job.
Delete TagDeletes the tag.
Delete UserDeletes the user.
Disable Saved SearchPerforms the disable Saved Search operation.
Dispatch Saved SearchPerforms the dispatch Saved Search operation.
Enable Local AppPerforms the enable Local App operation.
Enable Saved SearchPerforms the enable Saved Search operation.
Make an API CallPerforms an arbitrary authorized API call.
Reload IndexPerforms the reload Index operation.
Restart Local AppPerforms the restart Local App operation.
Send HEC EventSends the hEC Event.
Send HEC RawSends the hEC Raw.
Suppress Saved SearchPerforms the suppress Saved Search operation.
Update Data ModelUpdates the data Model.
Update Event TypeUpdates the event Type.
Update Field AliasUpdates the field Alias.
Update Field ExtractionUpdates the field Extraction.
Update HTTP InputUpdates the hTTP Input.
Update IndexUpdates the index.
Update KV Store RecordUpdates the kV Store Record.
Update Local AppUpdates the local App.
Update LookupUpdates the lookup.
Update MacroUpdates the macro.
Update MessageUpdates the message.
Update PanelUpdates the panel.
Update RoleUpdates the role.
Update Saved SearchUpdates the saved Search.
Update Saved Search ScheduleUpdates the saved Search Schedule.
Update Search JobUpdates the search Job.
Update TagUpdates the tag.
Update TCP InputUpdates the tCP Input.
Update TransformUpdates the transform.
Update UDP InputUpdates the uDP Input.
Update UserUpdates the user.
Update ViewUpdates the view.
Upload Lookup FileUploads the lookup File.

How to integrate Splunk in automation workflow?

3 simple steps to make your Splunk connected with other apps in automation workflows on WEXTL. Up to 10 minutes integration set up.

STEP 1

Select Splunk in workflow

Pick Splunk app in the workflow builder [4] - just one click to select the app.

STEP 2

Connect Splunk

When prompted, authorize access to Splunk in WEXTL once. Splunk credentials are encrypted and never shared with WEXTL. Authorization will be reused in any future API calls [3].

WEXTL wants to integrate with your Splunk account. Approve?

STEP 3

Build a workflow

Build your workflow with Splunk yourself or with WEXTL® AI Builder. Connect Splunk to any available integrations [5], or use HTTP node to go beyond them.

Splunk

How Splunk connects and integrates with WEXTL

Save and approve your credentials once — WEXTL® stores authorization information encrypted and reuses the authentication whenever Splunk app is called in workflows. That allows your developer tools automations to run without your attention, per defined schedule [7]. Explore documentation [6] for a detailed list of fields that Splunk supports.

Full Splunk API documentation

The following table illustrates what fields Splunk integration require during authorization flow inside our workflow builder [4].

Demonstration of Splunk connection step inside WEXTL Workflow Builder [4].

Field	Type	Help
Base URLRequired	url	Management port origin, e.g. https://splunk.example.com:8089
TokenRequired	password	—

Connect Splunk to popular apps on WEXTL

Enter a name of the other app you want to sync with Splunk below. Click on selected app to explore integration options with Splunk. If the app you search for is not available in WEXTL yet, you can use HTTP node [10] instead to integrate it directly.

Example automation with Splunk integration

Select Watch Search Job Done trigger from Splunk - this will be a starting point in your automation. Whenever event happens in Splunk, workflow will start [7] from Watch Search Job Done node.

Search for Create Search Job, connect it as the next step of integration sequence. You can use filters between Watch Search Job Done and Create Search Job, so only important data pass from Watch Search Job Done to the next step. WEXTL gives you full control over the process of Splunk automation. All parts of workflow are visible on the canvas [4].

Splunk on WEXTL has 150 modules for creating developer tools automations. Explore Splunk documentation for more.

Splunk

Watch Search Job Done

AWS Cognito

Performs action

AWS Cognito

Triggers

Splunk

Create Search Job

Demonstration of how visual Splunk automation [6] looks in WEXTL.

Frequently asked questions

Common questions about automating Splunk in your workflows.

Splunk has 2 triggers, including "Watch Fired Alerts" and "Watch Search Job Done". Triggers are start points of the workflow, and automations may start from them.

Integration has 148 actions, including "Get Alert Action", "Get Config", and "Get Current Context", and more. Refer to our Splunk Documentation for detailed inputs and outputs.

No. Most automations are built visually on the canvas by picking triggers, actions, and mapping fields. You can add custom JavaScript with Functions when advanced logic is needed — but our customers do that in rare cases [4].

Yes. Connections are authenticated per account, credentials are encrypted at rest, and you can enforce approvals and team-level access controls on any automation.

The Splunk integration on WEXTL runs directly on its vendor public API — every field name, authentication method, and rate limit is controlled by Splunk official API and covered in documentation [3]. WEXTL handles the request signing and pagination for you.

Absolutely. Where Splunk provides native webhooks, you can use instant triggers to eliminate polling delay. For custom webhooks, WEXTL offers Custom Webhook node, so you can start automation whenever Splunk or any other service sends event to webhook URL.

WEXTL is an AI-first visual canvas. The platform allows you to describe automation in plain text — and AI will wire nodes for Splunk inside the workflow builder [4]. You can also use built-in workflow nodes (AI Agent, Human in the Loop, Condition, Aggregate Results) in pair with Splunk modules to craft complex integration flows with branches, filtering, and conditional logic. There are absolutely no limits of what you can build.

References

List of sources used to gather information about the Splunk integration.

Splunk integration source code, module specs and credentials implementation.
Internal Splunk integration documentation, structured input and output parameters, scopes, and authentication methods.
Official Splunk vendor API documentation — used to verify field meanings, authentication flows, and anything our own specs don't fully capture.
WEXTL® Visual Workflow Builder, anonymized data from our technical support team.
WEXTL® Apps Library
WEXTL® Splunk App Documentation
WEXTL® Workflow Scheduler
WEXTL® HTTP node documentation

Splunk Integration

Supported triggers and actions for Splunk integration