Integration · Developer
AI agents for Splunk
Search your Splunk logs with SPL, run long searches and page through their results, list and run saved searches and reports, see fired alerts, and list indexes, through the Splunk REST API.
- Actions
- 8
- Read
- 7
- Write
- 1
Actions
What your agents can do in Splunk
Search your Splunk logs with SPL, run long searches and page through their results, list and run saved searches and reports, see fired alerts, and list indexes, through the Splunk REST API (Splunk Enterprise or Splunk Cloud Platform) with an authentication token, on its management port 8089 or on 443.
Read 7
Look things up. Nothing changes.
Run a search
Runs an SPL search and waits for it, returning up to count rows in results.
Start a long search
Starts an SPL search in the background and returns its sid at once.
Check a search
Reads a search job's progress in entry[0].content: dispatchState (QUEUED, PARSING, RUNNING, FINALIZING, DONE, FAILED, PAUSED), isDone, isFailed, doneProgress.
Read a search's results
Reads rows of a finished search, count at a time from offset, in results (with fields).
List saved searches and reports
Lists the saved searches, reports and alerts the token's user can see, in entry.
List fired alerts
Lists alerts that have fired and are still kept, in entry.
List indexes
Lists the indexes the token's user can see, in entry.
Write 1
Create, change or send.
Run a saved search
Starts a saved search or report now, as its owner and app from list_saved_searches (acl.owner, acl.app), optionally over another time range.
A person can approve first
Any write action can be set to wait for a person's approval before it runs, so an agent asks before it changes anything.
Connection
How it connects
Connect it once in the console, then give it to the agents and workflows that need it.
Paste an API key from your Splunk account.
What you enter
- Authentication token
Settings
- REST API address
Kept safe
- Credentials are stored encrypted with your organization's own keys.
- They are opened only by the process that makes the call, at the moment it runs, and never go into a prompt or the browser.
- Calls go only to the tool's own servers.
Ideas
Ideas to start with
Starting points made only from the actions above. Mix them with any other tool your agents can use.
- 01
Ask about your Splunk data
Ask a question in plain words. The agent can run a search, start a long search or check a search in Splunk, then answers with what it found.
- 02
Let an agent update Splunk
Have the agent run a saved search in Splunk as part of a larger task. Turn on approval and a person signs off on each change first.
- 03
Share what it finds in Slack
Give one agent Splunk and Slack: it can run a search in Splunk and post a summary to a Slack channel in the same run.
Works well with
More Developer tools
- GitHub4 actionsOpen and comment on issues, and start GitHub Actions workflows, in the repositories a personal access token can reach.
- GitLab4 actionsOpen and comment on issues, and start CI/CD pipelines, in the GitLab.com projects an access token can reach.
- Bitbucket3 actionsComment on and read pull requests, and start Bitbucket Pipelines, in the Bitbucket Cloud repositories your Atlassian API token can reach.
- Sentry3 actionsList, read, resolve and ignore error issues in a sentry.io organization, in its US or EU (Germany) data region.
- Datadog2 actionsPost events to the Datadog Event Explorer and send custom metric points, on any Datadog site, with an API key.
- PagerDuty4 actionsOpen, acknowledge and resolve PagerDuty incidents, add notes to them, and see who is on call for a schedule.
FAQ
Splunk and MyDeepAgents
Can MyDeepAgents connect to Splunk?
Yes. The Splunk connector has 8 actions: 7 read and 1 makes changes. Your agents can call them as tools, and your workflows can run them as steps.
How do I connect Splunk?
Paste an API key from your Splunk account. You'll need: Authentication token. The connection also asks for: REST API address. Credentials are stored encrypted with your organization's own keys and are opened only at the moment of a call.
Can an agent change data in Splunk without asking?
Only if you let it. Its one action that changes data can be set to wait for a person's approval before it runs.
Can I use Splunk in workflows as well as agents?
Yes. Every Splunk action also works as a step in a workflow, and the same connection serves your agents and your workflows.
Early access
Put Splunk to work
Connect it in a few minutes, give an agent the actions it needs, and decide which changes wait for a person.