Skip to main content
Unlisted page
This page is unlisted. Search engines will not index it, and only users having a direct link can access it.

Splunk Source Node

Not generally available

The Splunk Source node is not generally available in Fleak Data Workflow. The workflow builder offers it only to accounts where it has been enabled. For the connectors that are generally available, see Data Assets.

This page is retained for accounts where it is enabled.

Quick Reference​

  • Connection Profile: Select the Splunk connection profile; URL and authentication are configured on that profile.
  • Search Query: SPL (Search Processing Language) query defining the data to retrieve. Default: N/A.

Configuration​

Configuration keys below are relative to the node configuration. Use the field name in the panel when following instructions in the builder; required markers such as an asterisk are not part of the name.

Field in the panelConfiguration keyWhere to edit / when shown
Connection ProfileconnectionProfileIdSelect the Splunk connection profile; URL and authentication are configured on that profile
Search QuerysearchQueryNode panel — SPL (Search Processing Language) query defining the data to retrieve. Default: N/A. Required: Yes.

Overview​

The Splunk Source connector allows you to ingest data directly from Splunk Enterprise or Splunk Cloud Platform into your workflow. It functions by submitting a search job to the Splunk API and retrieving the results in batches.

This source is designed for batch ingestion. When the workflow runs, the connector connects to the Splunk management port, executes a specific Search Processing Language (SPL) query, waits for the job to complete, and ingests the resulting records.

Prerequisites​

Before configuring the source, ensure you have:

  • Network Access: Your workflow execution environment must be able to reach the Splunk Management port (typically port 8089).
  • Credentials: A valid Splunk username and password with permissions to execute search jobs.

Connection profile settings​

The selected Connection Profile supplies authentication, URL and SSL validation. These are not separate inputs on the node.

Use Credentials​

Configure the Username/Password credential on the Splunk connection profile.

  • Type: The connector requires standard Username and Password authentication.
  • Permissions: Ensure the user associated with these credentials has the search capability in Splunk.

Splunk URL​

Configure the URL of your Splunk Management endpoint on the connection profile.

  • Format: scheme://host[:port]
  • Example: https://splunk.example.com:8089
  • Important: You must include the protocol (http or https). The port is optional but recommended — the management port is usually 8089, not the web interface port (8000).

Search Query​

Enter the SPL (Search Processing Language) query to define the data you want to retrieve.

  • Example: search index=main sourcetype=access_log | head 100

Validate SSL Certificates​

The connection profile controls SSL certificate validation for HTTPS connections.

  • Default: false (SSL certificate validation is disabled)
  • Usage: Enable this when connecting to a Splunk instance with a valid, trusted SSL certificate. Keep it disabled for self-signed certificates or development environments.