SplunkPy

Run queries on Splunk and fetch Notable Events (Splunk ES versions up to 8.2).

Analytics & SIEM · Splunk

Configuration parameters

  • host — Server URL (required)
  • authentication — Username (required)
  • port — Port (required)
  • fetchQuery — Fetch events query
  • fetch_limit — Fetch Limit (Max.- 200, Recommended less than 50)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • useSplunkTime — Use Splunk Clock Time For Fetch
  • parseNotableEventsRaw — Parse Raw Part of Notable Events
  • replaceKeys — Replace with Underscore in Incident Fields
  • timezone — Timezone of the Splunk server, in minutes. For example, if GMT is gmt +3, set timezone to +180. For UTC, set the timezone to 0. When the Splunk server and the integration instance are on the same timezone, set the timezone to 0. This is relevant only for fetching and mirroring notable events. It must be specified when mirroring is enabled.
  • fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  • extractFields — Extract Fields - CSV fields that will be parsed out of _raw notable events
  • type_field — Event Type Field
  • use_cim — Use CIM Schemas for Mapping
  • mirror_direction — Incident Mirroring Direction
  • close_incident — Close Mirrored Cortex XSOAR Incidents (Incoming Mirroring)
  • close_extra_labels — Additional Splunk status labels to close on mirror (Incoming Mirroring)
  • close_end_status_statuses — Enable Splunk statuses marked as "End Status" to close on mirror (Incoming Mirroring)
  • close_notable — Close Mirrored Splunk Notable Events (Outgoing Mirroring)
  • unsecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • app — The app context of the namespace
  • cred_hec_token —
  • hec_token — HEC Token (HTTP Event Collector)
  • hec_url — HEC BASE URL (e.g: https://localhost:8088 or https://example.splunkcloud.com/).
  • enabled_enrichments — Enrichment Types
  • asset_enrich_lookup_tables — Asset enrichment lookup tables
  • identity_enrich_lookup_tables — Identity enrichment lookup tables
  • enrichment_timeout — Enrichment Timeout (Minutes)
  • num_enrichment_events — Number of Events Per Enrichment Type
  • extensive_logs — Advanced: Extensive logging (for debugging purposes). Do not use this option unless advised otherwise.
  • notable_time_source — Advanced: Time type to use when fetching events
  • occurrence_look_behind — Advanced: Fetch backwards window for the events occurrence time (minutes)
  • unique_id_fields — Advanced: Unique ID fields
  • userMapping — Enable user mapping
  • user_map_lookup_name — Users Lookup table name
  • xsoar_user_field — XSOAR user key
  • splunk_user_field — SPLUNK user key
  • incidentFetchInterval — Incidents Fetch Interval
  • comment_tag_from_splunk — Comment tag from Splunk
  • comment_tag_to_splunk — Comment tag to Splunk

Commands (25)

  • get-mapping-fields

    Query Splunk to retrieve a list of sample alerts by alert type. Used for mapping fetched incidents through the Get Schema option.

  • get-modified-remote-data

    Gets the list of notable events that were modified since the last update. This command should be used for debugging purposes, and is available from Cortex XSOAR version 6.1.

  • get-remote-data

    Gets data from a notable event. This method does not update the current incident, and should be used for debugging purposes.

  • splunk-get-indexes

    Prints all Splunk index names.

  • splunk-get-username-by-xsoar-user

    Returns the Splunk's username matching the given Cortex XSOAR's username.

  • splunk-job-create

    Creates a new search job in Splunk.

  • splunk-job-share

    Change job settings to share its results to all Splunk users, and change its TTL.

  • splunk-job-status

    Returns the status of a job.

  • splunk-kv-store-collection-add-entries

    Adds objects to a KV store utilizing the batch-save API.

  • splunk-kv-store-collection-config

    Configures the KV store fields.

  • splunk-kv-store-collection-create

    Creates a new KV store table.

  • splunk-kv-store-collection-create-transform

    Creates the KV store collection transform.

  • splunk-kv-store-collection-data-delete

    Deletes all data within the specified KV store collection or collections.

  • splunk-kv-store-collection-data-list

    Lists all data within a specific KV store collection or collections.

  • splunk-kv-store-collection-delete

    Deletes the specified KV stores.

  • splunk-kv-store-collection-delete-entry

    Deletes the specified object in store. The search can be a basic key-value pair or a full query.

  • splunk-kv-store-collection-search-entry

    Searches for specific objects in a store. The search can be a basic key-value pair or a full query.

  • splunk-kv-store-collections-list

    Lists all collections for the specified application.

  • splunk-notable-event-edit

    Updates existing notable events in Splunk ES.

  • splunk-parse-raw

    Parses the raw part of the event.

  • splunk-reset-enriching-fetch-mechanism

    Resets the enrichment mechanism of fetched notables.

  • splunk-results

    Returns the results of a previous Splunk search. You can use this command in conjunction with the splunk-job-create command.

  • splunk-search

    Searches Splunk for events. For human readable output, the table command is supported in the query argument. For example, `query=" * | table field1 field2 field3"` will generate a table with field1, field2, and field3 as headers.

  • splunk-submit-event

    Creates a new event in Splunk.

  • splunk-submit-event-hec

    Sends events to an HTTP Event Collector using the Splunk platform JSON event protocol.