Connect your own Splunk instance (self-hosted or Splunk Cloud) to run searches, manage saved searches/alerts, indexes, users and roles, send events via HTTP Event Collector, and audit search-head health -- from Imperal. Uses your own auth token (or username/password) -- nothing is hosted or proxied by Imperal beyond the request itself.
Every capability exposed by Splunk, metered per action and guarded by the two-step safety protocol.
connect_splunkwriteConnect your own self-hosted or Splunk Cloud instance by saving its base URL plus an auth token or username/password, after checking it actually works. Get a token from Splunk: Settings > Tokens > New Token.
list_connectionsreadList the connected Splunk instances.
disconnect_splunkwriteDisconnect a Splunk instance: deletes the saved credentials. Nothing in Splunk itself is changed.
save_hec_tokenwriteSave an HTTP Event Collector token for a connected Splunk instance, so send_event can push events into it. Get one from Settings > Data Inputs > HTTP Event Collector > New Token.
list_hec_tokensreadList saved HTTP Event Collector tokens (never reveals the secret value).
delete_hec_tokenwritePermanently delete a saved HEC token. Cannot be undone.
dispatch_searchwriteStart a new Splunk search job (SPL query). Returns a search job id (sid) -- poll get_search_status, then get_search_results once done.
get_search_statusreadRead a search job's current status -- whether it's done, and scan/event/result counts so far.
get_search_resultsreadRead a page of results from a completed (or still-running) search job.
cancel_searchwriteCancel a running search job.
list_saved_searchesreadList saved searches (and alerts) configured on the connected Splunk instance.
create_saved_searchwriteCreate a new saved search, optionally with a cron schedule to run it as an alert.
update_saved_searchwriteUpdate selected fields of an existing saved search. Only given fields change.
delete_saved_searchwritePermanently delete a saved search. Cannot be undone.
dispatch_saved_searchwriteRun a saved search right now, on demand, regardless of its schedule.
list_indexesreadList indexes configured on the connected Splunk instance, with current/max size.
list_usersreadList users registered on the connected Splunk instance.
list_rolesreadList roles configured on the connected Splunk instance, with their capabilities.
send_eventwriteSend an event into Splunk via HTTP Event Collector (HEC). Requires a saved HEC token (save_hec_token).
audit_search_headreadBuild one aggregated health report for the connected Splunk instance: saved searches without an alert action, and indexes near their size quota.
More extensions in Security ready to enable in one click.
Enable Splunk in your Imperal workspace in one click - 10,000 free starter credits included.