SplunkPy v2

Run queries on Splunk and fetch Splunk ES Findings and Investigations (Splunk ES 8.2+).

Analytics & SIEM · Splunk

Configuration parameters

  • server_url — Server URL (required)
  • authentication — (required)
  • fetchQuery — Fetch events query
  • max_fetch — Fetch Limit (Max.- 200, Recommended less than 50)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • parseFindingEventsRaw — Parse Raw Part of Finding Events
  • replaceKeys — Replace with Underscore in Incident Fields
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  • fetch_event_types — Event types to fetch
  • investigations_first_fetch — First fetch timestamp (Investigations)
  • investigations_fetch_query — Investigations fetch query
  • investigations_max_fetch — Maximum investigations per fetch
  • extractFields — Extract Fields - CSV fields that will be parsed out of raw finding events
  • mirror_direction — Incident Mirroring Direction
  • close_incident — Close Mirrored Cortex XSOAR Incidents (Incoming Mirroring)
  • close_extra_labels — Additional Splunk status labels to close on mirror (Incoming Mirroring)
  • close_end_status_statuses — Enable Splunk statuses marked as "End Status" to close on mirror (Incoming Mirroring)
  • close_finding — Close Mirrored Splunk ES Events (Outgoing Mirroring)
  • unsecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • app — The app context of the namespace
  • enabled_enrichments — Enrichment Types
  • asset_enrich_lookup_tables — Asset enrichment lookup tables
  • identity_enrich_lookup_tables — Identity enrichment lookup tables
  • enrichment_timeout — Enrichment Timeout (Minutes)
  • num_enrichment_events — Number of Events Per Enrichment Type
  • cred_hec_token —
  • hec_url — HEC BASE URL (e.g: https://localhost:8088 or https://example.splunkcloud.com/).
  • extensive_logs — Advanced: Extensive logging (for debugging purposes). Do not use this option unless advised otherwise.
  • finding_time_source — Advanced: Time type to use when fetching events
  • occurrence_look_behind — Advanced: Fetch backwards window for the events occurrence time (minutes)
  • unique_id_fields — Advanced: Unique ID Fields
  • userMapping — Enable user mapping
  • user_map_lookup_name — Users Lookup table name
  • xsoar_user_field — XSOAR user key
  • splunk_user_field — SPLUNK user key
  • note_tag_from_splunk — Note tag from Splunk
  • note_tag_to_splunk — Note tag to Splunk
  • incidentFetchInterval — Incidents Fetch Interval

Commands (27)

  • get-mapping-fields

    Query Splunk to retrieve a list of sample alerts by alert type. Used for mapping fetched incidents through the Get Schema option.

  • get-modified-remote-data

    Gets the list of finding events that were modified since the last update. This command should be used for debugging purposes, and is available from Cortex XSOAR version 6.1.

  • splunk-finding-event-edit

    Updates existing finding events in Splunk ES.

  • splunk-get-indexes

    Prints all Splunk index names.

  • splunk-get-username-by-xsoar-user

    Returns the Splunk's username matching the given Cortex XSOAR's username.

  • splunk-investigation-create

    Creates a new investigation in Splunk Enterprise Security.

  • splunk-investigation-list

    Lists investigations from Splunk Enterprise Security.

  • splunk-job-create

    Creates a new search job in Splunk.

  • splunk-job-share

    Change job settings to share its results to all Splunk users, and change its TTL.

  • splunk-job-status

    Returns the status of a job.

  • splunk-kv-store-collection-add-entries

    Adds objects to a KV store utilizing the batch-save API.

  • splunk-kv-store-collection-config

    Configures the KV store fields.

  • splunk-kv-store-collection-create

    Creates a new KV store table.

  • splunk-kv-store-collection-create-transform

    Creates the KV store collection transform.

  • splunk-kv-store-collection-data-delete

    Deletes all data within the specified KV store collection or collections.

  • splunk-kv-store-collection-data-list

    Lists all data within a specific KV store collection or collections.

  • splunk-kv-store-collection-delete

    Deletes the specified KV stores.

  • splunk-kv-store-collection-delete-entry

    Deletes the specified object in store. The search can be a basic key-value pair or a full query.

  • splunk-kv-store-collection-search-entry

    Searches for specific objects in a store. The search can be a basic key-value pair or a full query.

  • splunk-kv-store-collections-list

    Lists all collections for the specified application.

  • splunk-parse-raw

    Parses the raw part of the event.

  • splunk-reset-enriching-fetch-mechanism

    Resets the enrichment mechanism of fetched findings.

  • splunk-results

    Returns the results of a previous Splunk search. You can use this command in conjunction with the splunk-job-create command.

  • splunk-search

    Searches Splunk for events. For human readable output, the table command is supported in the query argument. For example, `query=" * | table field1 field2 field3"` will generate a table with field1, field2, and field3 as headers.

  • splunk-submit-event

    Creates a new event in Splunk.

  • splunk-submit-event-hec

    Sends events to an HTTP Event Collector using the Splunk platform JSON event protocol.

  • splunk-update-investigation

    Updates existing investigations in Splunk ES. Supports updating fields such as owner, status, urgency, disposition, name, and description, adding a note, and appending finding IDs to the investigation. Note that `findings` (and `finding_times`) can only be used when exactly one investigation ID is provided in `event_ids`.