data.splunk_search plugin

[traut]

Background

Splunk is a leader in SIEM market and is widely used in the industry.

• Splunk Cloud Platform is a cloud solution by Splunk.
• Splunk Enterprise is an on-prem solution by Splunk.

The APIs for both solutions are similar, but Splunk Cloud Platform requires additional access controls. This issue describes the plugin that works with Splunk Enterprise API.

Features

The plugin should be able to send a search request to the API and return the data.

Specification

• configuration:
  • auth_token -- a string with a Splunk authentication token
  • host -- (optional) a string with a hostname for a Splunk instance
  • deployment_name -- (optional) a string with a deployment name for Splunk Cloud instance.
• interface:
  • search_query -- (required) string attribute that contains a Splunk query
  • max_count -- (optional) an int, limits the number of events returned by search
  • status_buckets -- (optional) an int value, indicates the most status buckets to generate
  • rf -- (optional) a list of strings, defines additional fields to be returned
  • earliest_time -- (optional) a string value
  • latest_time -- (optional) a string value

Other non-configurable parameters for API calls:

• for search/jobs endpoint
  • id for should be set to fabric_<randomized-string>
  • exec_mode should be set to blocking
• for search/jobs/<sid>/results endpoint - output_mode should be set to json

For the exact format of the parameters, see POST request parameters for search/jobs endpoint here.

If host is provided, the base URL is https://<host>:8089/
If deployment_name is provided, the base URL is https://<deployment-name>.splunkcloud.com:8089/

This plugin should be a part of splunk plugin package.

Usage example

• auth_token is used it as a basic auth token (docs)
• search_query value is submitted via HTTP POST to /services/search/jobs endpoint with all set parameters.
• the results are fetched from /services/search/v2/jobs/<sid>/results and returned

Additional context

• search/jobs endpoint docs - https://docs.splunk.com/Documentation/SplunkCloud/9.1.2308/RESTREF/RESTsearch#search.2Fjobs
• Splunk Enterprise API manual -- https://docs.splunk.com/Documentation/Splunk/latest/RESTUM/RESTusing
• Creating searches with REST API -- https://docs.splunk.com/Documentation/Splunk/9.1.3/RESTTUT/RESTsearches
• An example code for a search request via API - https://gist.github.com/ww9rivers/4bfc59780e5263aabc738a8f1166e740