Splunk Connector

Splunk Connector

Query Splunk REST API to detect which assets are actively sending security events.

Category	SIEM / Log Management
Modes	batch
Image	ghcr.io/silentpulse/connector-splunk:1.0.0
Manifest	hub.silentpulse.io/universe/packages/splunk/manifest.json

Requirements

• Splunk Enterprise 8.0+ or Splunk Cloud
• REST API access (port 8089 for on-prem)
• Bearer token or username/password credentials

Configuration

Connection Fields

Field	Type	Required	Description
base_url	url	yes	Splunk management API endpoint
token	password	no	Splunk Bearer token (preferred)
username	text	no	Basic auth username
password	password	no	Basic auth password
skip_tls_verify	boolean	no	Skip TLS certificate verification

Query Fields

Field	Type	Required	Default	Description
search_query	textarea	yes		Splunk SPL search query
index	text	no	main	Splunk index to search
hostname_field	text	yes	host	Field containing the asset hostname
time_window	text	no	15m	Lookback period for searches

Authentication

Supports both Bearer token and basic (username/password) authentication. Token auth is recommended for production.

Scaling

Resource	Request
CPU	100m
Memory	256Mi
Min replicas	1
Max replicas	4

Limitations

• Search jobs are limited by Splunk license quotas
• Large time windows may timeout