Splunk

Connect your own self-hosted or Splunk Cloud instance by saving its base URL plus an auth token or username/password, after checking it actually works. Get a token from Splunk: Settings > Tokens > New Token.

List the connected Splunk instances.

Disconnect a Splunk instance: deletes the saved credentials. Nothing in Splunk itself is changed.

Save an HTTP Event Collector token for a connected Splunk instance, so send_event can push events into it. Get one from Settings > Data Inputs > HTTP Event Collector > New Token.

List saved HTTP Event Collector tokens (never reveals the secret value).

Permanently delete a saved HEC token. Cannot be undone.

Start a new Splunk search job (SPL query). Returns a search job id (sid) -- poll get_search_status, then get_search_results once done.

Read a search job's current status -- whether it's done, and scan/event/result counts so far.

Read a page of results from a completed (or still-running) search job.

Cancel a running search job.

List saved searches (and alerts) configured on the connected Splunk instance.

Create a new saved search, optionally with a cron schedule to run it as an alert.

Update selected fields of an existing saved search. Only given fields change.

Permanently delete a saved search. Cannot be undone.

Run a saved search right now, on demand, regardless of its schedule.

List indexes configured on the connected Splunk instance, with current/max size.

List users registered on the connected Splunk instance.

List roles configured on the connected Splunk instance, with their capabilities.

Send an event into Splunk via HTTP Event Collector (HEC). Requires a saved HEC token (save_hec_token).

Build one aggregated health report for the connected Splunk instance: saved searches without an alert action, and indexes near their size quota.