--- title: "Splunk Integration" description: "Run SPL searches, manage saved searches, ingest events through HEC, and inspect indexes and server health from your flows over the Splunk REST API and HTTP Event Collector." url: https://flowrunner.ai/integrations/splunk date_modified: 2026-08-01T02:40:32-07:00 --- # Splunk [Developer Tools](https://flowrunner.ai/integrations/category/developer-infrastructure) Run SPL searches, manage saved searches, ingest events through HEC, and inspect indexes and server health from your flows over the Splunk REST API and HTTP Event Collector. [Verified](https://flowrunner.ai/integrations/verified "What does verified mean?") · 13 actions · API key · available [Splunk website](https://www.splunk.com/) · [Platform Documentation](https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch) · Capability data verified 2026-08-12 1. A scheduled flow runs an SPL search for errors over the last interval 2. Agent reads the result rows, such as counts by URI or host 3. Agent compares the counts against a threshold to decide if this is signal or noise 4. Agent records the metrics summary and attaches the offending events 5. Agent posts the summary and event sample to the on-call channel 6. The on-call engineer decides whether to open an incident before any page goes out ## What This Integration Enables FlowRunner agents use Splunk to close the gap between a search result and the rest of the stack. An agent can run an SPL search on a schedule with the async job flow or a oneshot call, route the results into alerts, tickets, or dashboards, and trigger a saved search or alert and act on what it returns. It can ingest application, workflow, and webhook events into Splunk through the HTTP Event Collector for centralized logging, and monitor index sizes, event counts, and server health as part of an operational flow. What it does not do is decide on its own that a result is worth paging a human. That call belongs to the on-call engineer, and the agent brings them the context to make it. ### Without FlowRunner **Dashboard watching**: Someone keeps a Splunk tab open and eyeballs it for spikes **Late escalation**: An error trend is noticed hours after it started **Noisy paging**: Every threshold breach pages a person, real or not ### With FlowRunner **Scheduled search**: The agent runs the SPL search on an interval and reads the rows **Early summary**: A metrics summary reaches the channel as soon as the trend appears **Human on the page**: Only a person turns a flagged result into an incident ## Use Case Scenarios ### Scheduled search into a triaged summary A scheduled flow runs a oneshot SPL search for HTTP 500s grouped by URI. The agent reads the result rows and compares the counts against a threshold. Below the threshold, it logs the numbers and moves on. Above it, the agent posts a summary and a sample of the offending events to the on-call channel and holds. It does not open an incident by itself. The team sees a triaged summary instead of a raw dashboard, and a person decides what happens next. ### Central event ingestion A set of workflows across the business emit lifecycle events. The agent calls Send Event to write each one into Splunk through the HTTP Event Collector, tagging the index and sourcetype the HEC token permits. Operational events from many systems land in one place, searchable alongside application logs. ### Saved-search alert with an escalation gate A saved search that represents a known alert condition runs on a schedule. When Run Saved Search returns rows, the agent assembles the matched events and the search context and posts them to the responding team. It waits for a human to confirm the escalation. Only after an engineer confirms does the flow open an incident in the on-call tool. A saved search fires often; a page does not. ## Human-in-Loop Highlight The human-in-loop moment in Splunk is the escalation gate. Running searches, ingesting events, and reading index health are all safe to automate, so the agent does them by rule and on a schedule. Deciding that a search result is a real incident worth paging a person is a judgment call, so the agent stops. When a scheduled search or a saved-search alert returns results that breach a threshold, the agent posts the metrics summary and a sample of the matched events to the on-call channel and asks: "index=main returned 214 status=500 events in the last 5 minutes, up from a 12-event baseline. Open an incident?" The on-call engineer confirms or dismisses. Only on a confirm does the flow open the incident. The agent watches continuously. A person owns the page. Agent processes routinely Detects exception requiring judgment Clear match Continues automatically Ambiguous Routes to human via preferred channel Human decides Agent resumes with decision ## Agent Capabilities 13 actions ### Search 5 - **Cancel Search Job** Cancel a running search job to free resources. - **Create Search Job** Dispatch an SPL search and return its search ID. Used to start the async poll-and-fetch flow for a large search. - **Get Search Job Status** Retrieve a search job's status. Polled until the job is done. - **Get Search Results** Retrieve the results of a completed search job by its search ID. - **Run Oneshot Search** Run a bounded SPL search and return results in a single call. Used for small, fast searches. ### Saved Searches 3 - **Get Saved Search** Retrieve a saved search definition. - **List Saved Searches** List the saved searches. - **Run Saved Search** Run a saved search or alert and return its results. ### HTTP Event Collector 2 - **Send Event** Send a structured event to Splunk through the HTTP Event Collector. - **Send Raw Event** Send a raw event payload to Splunk through the HTTP Event Collector. ### Indexes 2 - **Get Index** Retrieve an index's size and event count. - **List Indexes** List the indexes on the instance. ### Server 1 - **Get Server Info** Retrieve server info and health. Used as a connection check. ## Frequently Asked Questions ### What can FlowRunner do with Splunk? FlowRunner agents can run Create Search Job, Get Search Job Status, and Get Search Results in Splunk, plus 10 more actions. ### Does connecting Splunk to FlowRunner require OAuth? No. Splunk connects to FlowRunner with an API key, no OAuth flow required. ### Can Splunk trigger a FlowRunner workflow automatically? Splunk doesn't currently expose triggers in FlowRunner. It connects as an action step inside workflows started by another trigger. **Work at Splunk?** This integration exposes Splunk to AI agents on every FlowRunner plan, including through MCP, at no cost to you. [See what FlowRunner offers integration partners](https://flowrunner.ai/integrations/partners), including how to keep this page current. --- Markdown version of https://flowrunner.ai/integrations/splunk. Site index: https://flowrunner.ai/llms.txt