SplunkPyPreRelease

Runs queries on Splunk servers.

Analytics & SIEM · Splunk Prerelease (Deprecated)

Configuration parameters

  • host — Host - IP (x.x.x.x) (required)
  • authentication — Username (required)
  • port — Port (required)
  • fetchQuery — Fetch events query
  • fetch_limit — Fetch Limit (Max.- 200, Recommended less than 50)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • useSplunkTime — Use Splunk Clock Time For Fetch
  • parseNotableEventsRaw — Parse Raw Part of Notable Events
  • replaceKeys — Replace with Underscore in Incident Fields
  • timezone — Timezone of the Splunk server, in minutes. For example, if GMT is gmt +3, set timezone to +180. For UTC, set the timezone to 0. (Set only if the Splunk server is different than the Cortex XSOAR server.) Relevant only for fetching and mirroring notable events.
  • fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  • earliest_fetch_time_fieldname — Earliest time to fetch (The name of the Splunk field whose value defines the query's earliest time to fetch.)
  • latest_fetch_time_fieldname — Latest time to fetch (The name of the Splunk field whose value defines the query's latest time to fetch.)
  • extractFields — Extract Fields - CSV fields that will be parsed out of _raw notable events
  • type_field — Event Type Field
  • use_cim — Use CIM Schemas for Mapping
  • mirror_direction — Incident Mirroring Direction
  • close_incident — Close Mirrored XSOAR Incident
  • close_notable — Close Mirrored Splunk Notable Event
  • unsecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • app — The app context of the namespace
  • hec_token — HEC Token (HTTP Event Collector)
  • hec_url — HEC URL (e.g: https://localhost:8088).
  • use_requests_handler — Use Python requests handler
  • enabled_enrichments — Enrichment Types
  • enrichment_timeout — Enrichment Timeout (Minutes)
  • num_enrichment_events — Number of Events Per Enrichment Type
  • extensive_logs — Advanced: Extensive logging (for debugging purposes) - Please do not use this option unless advised otherwise.
  • occurrence_look_behind — Advanced: Fetch backwards window for the events occurrence time
  • unique_id_fields — Advanced: Unique ID fields

Commands (22)

  • get-mapping-fields

    Query Splunk to retrieve a list of sample alerts by alert type. Used for mapping fetched incidents through the Get Schema option.

  • get-modified-remote-data

    Gets the list of notable events that were modified since the last update. This command should be used for debugging purposes, and is available from Cortex XSOAR version 6.1.

  • get-remote-data

    Gets data from a notable event. This method does not update the current incident, and should be used for debugging purposes.

  • splunk-get-indexes

    Prints all Splunk index names.

  • splunk-job-create

    Creates a new search job in Splunk.

  • splunk-job-status

    Returns the status of a job.

  • splunk-kv-store-collection-add-entries

    Adds objects to a KV store utilizing the batch-save API.

  • splunk-kv-store-collection-config

    Configures the KV store fields.

  • splunk-kv-store-collection-create

    Creates a new KV store table.

  • splunk-kv-store-collection-data-delete

    Deletes all data within the specified KV store collection or collections.

  • splunk-kv-store-collection-data-list

    Lists all data within a specific KV store collection or collections.

  • splunk-kv-store-collection-delete

    Deletes the specified KV stores.

  • splunk-kv-store-collection-delete-entry

    Deletes the specified object in store. The search can be a basic key-value pair or a full query.

  • splunk-kv-store-collection-search-entry

    Searches for specific objects in a store. The search can be a basic key-value pair or a full query.

  • splunk-kv-store-collections-list

    Lists all collections for the specified application.

  • splunk-notable-event-edit

    Updates existing notable events in Splunk ES.

  • splunk-parse-raw

    Parses the raw part of the event.

  • splunk-reset-enriching-fetch-mechanism

    Resets the enrichment mechanism of fetched notables.

  • splunk-results

    Returns the results of a previous Splunk search. You can use this command in conjunction with the splunk-job-create command.

  • splunk-search

    Searches Splunk for events.

  • splunk-submit-event

    Creates a new event in Splunk.

  • splunk-submit-event-hec

    Sends events to an HTTP Event Collector using the Splunk platform JSON event protocol.