Splunk

Use the @bijection/connectors/splunk entrypoint to declare Splunk resources.

Availability

This page describes the pinned source package. Published availability is unestablished for this artifact. Source build and package availability.

Resources and modes

Resource	Mode	Description
Events	`search`	Base search by index time, one bounded page per pass

Declare a resource in application code, then bind deployment-specific settings and credentials. See typed resources, connections and source inspection.

Events

search: Base search by index time, one bounded page per pass

The following example matches configuration standard.

import { splunk } from "@bijection/connectors/splunk";
export const errors = splunk.events.search({
  search: "index=web sourcetype=access_combined status>=500",
});

Inferred record types

Resource without an operational record table

Configuration: standard

Case: splunk/events/search/standard. Connection and resource configuration are declared by this exact case. Credential kind: splunk. Keep credential material in the private credential inventory.

Setting	Type	Required	Owner
`url`	string	Yes	Shared connection

Complete configuration contract

{
  "setup": [],
  "resource": {
    "access": {},
    "defaults": {},
    "connector": "splunk",
    "output": {
      "kind": "single",
      "collection": "events"
    },
    "credential_kind": "splunk",
    "connection_fields": [
      "url"
    ],
    "address": {
      "kind": "setup",
      "field": "url"
    }
  },
  "connection_setup": {
    "type": "object",
    "value": {
      "url": {
        "fieldType": {
          "type": "string"
        },
        "optional": false
      }
    }
  },
  "execution": null
}

Native admission analysis is available for this exact declaration. Collection: events

Contract	Meaning
Initial	Enumeration of observed records
Changes	Repeated observations of current records
Deletions	Deletion detection unsupported
Resume	No continuation
Gap	Not applicable
Retention	Unspecified

Complete native profile

{
  "movement": {
    "exchanges": {
      "search": {
        "200": {
          "placement": "retained_bytes",
          "interpretation": "json",
          "projectsBeforeRetention": false,
          "retainedBodyLimitBytes": "524288",
          "fileLimitBytes": null
        },
        "400": {
          "placement": "retained_bytes",
          "interpretation": "opaque",
          "projectsBeforeRetention": false,
          "retainedBodyLimitBytes": "524288",
          "fileLimitBytes": null
        },
        "503": {
          "placement": "retained_bytes",
          "interpretation": "opaque",
          "projectsBeforeRetention": false,
          "retainedBodyLimitBytes": "524288",
          "fileLimitBytes": null
        }
      }
    },
    "nativeInputLimitBytes": null,
    "steps": [
      {
        "id": "acquire.1",
        "inputs": [],
        "action": {
          "operation": "acquire",
          "subject": "exchange search",
          "limitBytes": null
        }
      },
      {
        "id": "retain.1",
        "inputs": [
          "acquire.1"
        ],
        "action": {
          "operation": "retain",
          "subject": "acquisition evidence",
          "reason": "recovery",
          "release": "acquisition_custody"
        }
      },
      {
        "id": "interpret.1",
        "inputs": [
          "retain.1"
        ],
        "action": {
          "operation": "interpret",
          "subject": "acquired input",
          "produces": "records"
        }
      },
      {
        "id": "materialize.1",
        "inputs": [
          "interpret.1"
        ],
        "action": {
          "operation": "materialize",
          "subject": "source rows",
          "reason": "serving",
          "release": "replacement"
        }
      },
      {
        "id": "publish.1",
        "inputs": [
          "materialize.1"
        ],
        "action": {
          "operation": "publish",
          "subject": "source rows",
          "visibility": "with_acquisition"
        }
      }
    ]
  },
  "initial": "enumeration",
  "changes": "observations",
  "deletions": "unsupported",
  "resume": "none",
  "retentionMs": null,
  "gap": "not_applicable",
  "limits": {
    "http_response_bytes": "524288"
  },
  "restrictions": [],
  "commands": {}
}

Commands, occurrences and artifacts

{
  "records": {
    "events": {
      "protocol": "record_observation",
      "coverage": "records",
      "consistency": "observations",
      "atomicity": "record",
      "history": "observations",
      "recordRefresh": false,
      "reconciliation": false,
      "notifications": false,
      "snapshotMaxRows": null,
      "profile": {
        "movement": {
          "exchanges": {
            "search": {
              "200": {
                "placement": "retained_bytes",
                "interpretation": "json",
                "projectsBeforeRetention": false,
                "retainedBodyLimitBytes": "524288",
                "fileLimitBytes": null
              },
              "400": {
                "placement": "retained_bytes",
                "interpretation": "opaque",
                "projectsBeforeRetention": false,
                "retainedBodyLimitBytes": "524288",
                "fileLimitBytes": null
              },
              "503": {
                "placement": "retained_bytes",
                "interpretation": "opaque",
                "projectsBeforeRetention": false,
                "retainedBodyLimitBytes": "524288",
                "fileLimitBytes": null
              }
            }
          },
          "nativeInputLimitBytes": null,
          "steps": [
            {
              "id": "acquire.1",
              "inputs": [],
              "action": {
                "operation": "acquire",
                "subject": "exchange search",
                "limitBytes": null
              }
            },
            {
              "id": "retain.1",
              "inputs": [
                "acquire.1"
              ],
              "action": {
                "operation": "retain",
                "subject": "acquisition evidence",
                "reason": "recovery",
                "release": "acquisition_custody"
              }
            },
            {
              "id": "interpret.1",
              "inputs": [
                "retain.1"
              ],
              "action": {
                "operation": "interpret",
                "subject": "acquired input",
                "produces": "records"
              }
            },
            {
              "id": "materialize.1",
              "inputs": [
                "interpret.1"
              ],
              "action": {
                "operation": "materialize",
                "subject": "source rows",
                "reason": "serving",
                "release": "replacement"
              }
            },
            {
              "id": "publish.1",
              "inputs": [
                "materialize.1"
              ],
              "action": {
                "operation": "publish",
                "subject": "source rows",
                "visibility": "with_acquisition"
              }
            }
          ]
        },
        "initial": "enumeration",
        "changes": "observations",
        "deletions": "unsupported",
        "resume": "none",
        "retentionMs": null,
        "gap": "not_applicable",
        "limits": {
          "http_response_bytes": "524288"
        },
        "restrictions": [],
        "commands": {}
      }
    }
  },
  "occurrences": null,
  "artifacts": {
    "raw_archive": false,
    "native_file_transfer_limit_bytes": null,
    "external_versions": false,
    "files": {}
  },
  "commands": {}
}

Recorded checks

Requirement	Scope	Evidence	Result
page-publication-recovery	{“kind”:“collection”,“name”:“events”}	Declared from Splunk’s REST documentation; no check exercises it against Splunk and it has not been qualified.	Execution result unavailable
identity-account	{“kind”:“connection”}	Declared from Splunk’s REST documentation; no check exercises it against Splunk and it has not been qualified.	Execution result unavailable

Hosted qualification: unestablished for this catalog configuration. Installed connections report their own identity, authority and current status.

Provider guidance

Compiled declaration examples and configuration details are published in the connector reference. Compiled declaration examples and configuration details are published in the connector reference. A read-only feed of the events one base search matches, in Splunk Enterprise or Splunk Cloud Platform. Nothing here writes to Splunk. The connection is the management-port base URL. The credential is a Splunk authentication token, sent as Authorization: Bearer <token>. Splunk Cloud Platform exposes the REST port only after the stack’s REST access is enabled. Identity is the guid from services/server/info; in a search head cluster each member has its own, so a connection behind a load balancer may be identified by whichever member answered. Each pass is one oneshot search, search <base> | sort 0 +num(_indextime) | head <pageRows>, bounded by index_earliest (the latest _indextime the previous pass read, inclusive) and index_latest=-<settleSeconds>s. The boundary second is re-read and deduplicated by _indextime. A full page hands its latest second to the next pass, so a backlog drains one page per interval. A full page whose events all share one second cannot advance and is refused: raise pageRows. The base search is search-command terms only: no |, no subsearch, no macro, no time modifier, and no leading search. earliest bounds event time; an event older than it is never read, however late it was indexed. Not observed: events made unsearchable by | delete or by bucket freezing, and events whose _indextime falls behind the carried second after the settle window (for example from an indexer with a skewed clock). A key is _bkt with _cd; Splunk documents no event identifier. Nothing here has run against Splunk or been qualified.

Provider references

Provider references and prerequisites are maintained in the connector guidance above. No separate provider-documentation review date is recorded.

Source and evidence

Canonical connector source, native analysis and check receipts. Connector artifact: 905888ea276a2a28e36981a79e8142b2547ea451c3e63162cb6915ad4a7d1305. The resource declaration examples above are compiled and compared with exact catalog declarations. Recorded checks apply only to their source, declaration and runtime identities. Configure a connection and inspect its status to establish deployment-specific readiness.

Get Started

Use-case atlas

Platform

Data and Operations

Guides

Client Libraries

Tools

API Reference

Availability

Resources and modes

Events

search: Base search by index time, one bounded page per pass

Configuration: standard

Provider guidance

Provider references

Source and evidence

​Availability

​Resources and modes

​Events

​search: Base search by index time, one bounded page per pass

​Configuration: standard

​Provider guidance

​Provider references

​Source and evidence

Availability

Resources and modes

Events

search: Base search by index time, one bounded page per pass

Configuration: standard

Provider guidance

Provider references

Source and evidence