Splunk

Source: https://runstack.engineer/docs/toolkits/splunk

Run SPL searches, manage saved searches, indexes, HEC inputs, alerts and KV Store via the Splunk REST API.

Tools (29):

Tool	Description
`splunkCreateSearchJob`	Run an SPL search as an async job. Returns a sid — poll status, then fetch results. Defaults to the last 24 hours.
`splunkGetSearchJobStatus`	Check an SPL search job state and progress. Use to poll until dispatchState is DONE before fetching results.
`splunkGetSearchJobResults`	Fetch transformed results of a completed search job with pagination. Use after status shows DONE.
`splunkGetSearchJobEvents`	Fetch raw untransformed events of a search job (available while it still runs). Use for raw log inspection.
`splunkRunOneShotSearch`	Run a short SPL search synchronously and get results directly. Use for quick lookups; prefer async jobs for long searches.
`splunkExportSearch`	Stream SPL search results as they become available (no sid). Use for large result sets and long-running searches.
`splunkListSearchJobs`	List recent search jobs for the connected user with state and progress. Use to find lost sids or audit search activity.
`splunkCancelSearchJob`	Cancel and delete a search job, freeing its resources. Use to stop runaway or unwanted searches.
`splunkControlSearchJob`	Pause, unpause or finalize a running search job to manage long-running search load.
`splunkListSavedSearches`	List saved searches (reports and alerts) with SPL, schedule and disabled state. Use to discover reusable searches.
`splunkGetSavedSearch`	Get a saved search including full SPL, schedule, alert condition and configured alert actions.
`splunkCreateSavedSearch`	Create a saved search (report or scheduled alert) with SPL, cron schedule and optional email alerting.
`splunkUpdateSavedSearch`	Update a saved search SPL, schedule, description or enabled state.
`splunkDeleteSavedSearch`	Delete a saved search. Scheduled runs stop — confirm with the user first.
`splunkDispatchSavedSearch`	Run a saved search now and get its sid. Use to trigger reports or test alerts on demand.
`splunkListIndexes`	List indexes with event counts, sizes and disabled state. Use to discover searchable data and storage usage.
`splunkGetIndex`	Get index details including paths, retention, frozen/cold behavior and size limits.
`splunkCreateIndex`	Create a new event index with optional storage paths and size cap. Use before onboarding a new data source.
`splunkDeleteIndex`	Delete an index and all its data. Irreversible — confirm with the user first.
`splunkListDataInputs`	List data inputs (monitor, TCP, UDP, script, HTTP) with their collection settings. Use to audit data onboarding.
`splunkListHecTokens`	List HTTP Event Collector tokens with their allowed indexes. Tokens are ingest credentials — handle as sensitive.
`splunkCreateHecToken`	Create an HTTP Event Collector token for a new log source. Returns the token value — store it for the sender.
`splunkSendHecEvent`	Send a JSON event to Splunk via HTTP Event Collector. Use to ingest application or test events.
`splunkListUsers`	List Splunk users with roles, email and real name. Use to audit access and find search owners.
`splunkListRoles`	List Splunk roles with capabilities, default app and inherited roles. Use to audit permissions.
`splunkListFiredAlerts`	List fired alert instances with severity and trigger time. Use to triage recent alert firings.
`splunkGetServerInfo`	Get server info: version, build, GUID, roles and license state. Use to check deployment health and version.
`splunkListKvStoreCollections`	List KV Store collections (app lookups/state tables) with their fields. Use to discover lookup data available to searches.
`splunkQueryKvStoreCollection`	Query records in a KV Store collection with an optional Mongo-style filter. Use to read lookup/state data.