Description:
Retrieves data from Splunk Enterprise.
Tags:
get, splunk, logs
Properties:
In the list below, the names of required properties appear in bold. Any other properties (not in bold) are considered optional. The table also indicates any default values, and whether a property is considered “sensitive”, meaning that its value will be encrypted. Before entering a value in a sensitive property, ensure that the nifi.properties file has an entry for the property nifi.sensitive.props.key.
| Name | Default Value | Allowable Values | Description |
| Scheme | https |
* https * http |
The scheme for connecting to Splunk. |
| Hostname | localhost | The ip address or hostname of the Splunk server. | |
| Port | 8089 | The port of the Splunk server. | |
| Query | search * | head 100 | The query to execute. Typically beginning with a <search> command followed by a search clause, such as <search source="tcp:7689"> to search for messages received on TCP port 7689. | |
| Time Field Strategy | Event Time |
* Event Time  * Index Time
|
Indicates whether to search by the time attached to the event, or by the time the event was indexed in Splunk. |
| Time Range Strategy | Provided |
* Managed from Beginning * Managed from Current * Provided
|
Indicates how to apply time ranges to each execution of the query. Selecting a managed option allows the processor to apply a time range from the last execution time to the current execution time. When using <Managed from Beginning>, an earliest time will not be applied on the first execution, and thus all records searched. When using <Managed from Current> the earliest time of the first execution will be the initial execution time. When using <Provided>, the time range will come from the Earliest Time and Latest Time properties, or no time range will be applied if these properties are left blank. |
| Earliest Time | The value to use for the earliest time when querying. Only used with a Time Range Strategy of Provided. See Splunk's documentation on Search Time Modifiers for guidance in populating this field. | ||
| Latest Time | The value to use for the latest time when querying. Only used with a Time Range Strategy of Provided. See Splunk's documentation on Search Time Modifiers for guidance in populating this field. | ||
| Time Zone | UTC |
* Etc/GMT+12 * Etc/GMT+11 * Pacific/Midway * Pacific/Niue * Pacific/Pago_Pago * Pacific/Samoa * US/Samoa * America/Adak * America/Atka * Etc/GMT+10 * HST * Pacific/Honolulu * Pacific/Johnston * Pacific/Rarotonga * Pacific/Tahiti * SystemV/HST10 * US/Aleutian * US/Hawaii * Pacific/Marquesas * AST * America/Anchorage * America/Juneau * America/Nome * America/Sitka * America/Yakutat * Etc/GMT+9 * Pacific/Gambier * SystemV/YST9 * SystemV/YST9YDT * US/Alaska * America/Dawson * America/Ensenada * America/Los_Angeles * America/Metlakatla * America/Santa_Isabel * America/Tijuana * America/Vancouver * America/Whitehorse * Canada/Pacific * Canada/Yukon * Etc/GMT+8 * Mexico/BajaNorte * PST * PST8PDT * Pacific/Pitcairn * SystemV/PST8 * SystemV/PST8PDT * US/Pacific * US/Pacific-New * America/Boise * America/Cambridge_Bay * America/Chihuahua * America/Creston * America/Dawson_Creek * America/Denver * America/Edmonton * America/Hermosillo * America/Inuvik * America/Mazatlan * America/Ojinaga * America/Phoenix * America/Shiprock * America/Yellowknife * Canada/Mountain * Etc/GMT+7 * MST * MST7MDT * Mexico/BajaSur * Navajo * PNT * SystemV/MST7 * SystemV/MST7MDT * US/Arizona * US/Mountain * America/Bahia_Banderas * America/Belize * America/Cancun * America/Chicago * America/Costa_Rica * America/El_Salvador * America/Guatemala * America/Indiana/Knox * America/Indiana/Tell_City * America/Knox_IN * America/Managua * America/Matamoros * America/Menominee * America/Merida * America/Mexico_City * America/Monterrey * America/North_Dakota/Beulah * America/North_Dakota/Center * America/North_Dakota/New_Salem * America/Rainy_River * America/Rankin_Inlet * America/Regina * America/Resolute * America/Swift_Current * America/Tegucigalpa * America/Winnipeg * CST * CST6CDT * Canada/Central * Canada/East-Saskatchewan * Canada/Saskatchewan * Chile/EasterIsland * Etc/GMT+6 * Mexico/General * Pacific/Easter * Pacific/Galapagos * SystemV/CST6 * SystemV/CST6CDT * US/Central * US/Indiana-Starke * America/Atikokan * America/Bogota * America/Cayman * America/Coral_Harbour * America/Detroit * America/Eirunepe * America/Fort_Wayne * America/Grand_Turk * America/Guayaquil * America/Havana * America/Indiana/Indianapolis * America/Indiana/Marengo * America/Indiana/Petersburg * America/Indiana/Vevay * America/Indiana/Vincennes * America/Indiana/Winamac * America/Indianapolis * America/Iqaluit * America/Jamaica * America/Kentucky/Louisville * America/Kentucky/Monticello * America/Lima * America/Louisville * America/Montreal * America/Nassau * America/New_York * America/Nipigon * America/Panama * America/Pangnirtung * America/Port-au-Prince * America/Porto_Acre * America/Rio_Branco * America/Thunder_Bay * America/Toronto * Brazil/Acre * Canada/Eastern * Cuba * EST * EST5EDT * Etc/GMT+5 * IET * Jamaica * SystemV/EST5 * SystemV/EST5EDT * US/East-Indiana * US/Eastern * US/Michigan * America/Caracas * America/Anguilla * America/Antigua * America/Aruba * America/Asuncion * America/Barbados * America/Blanc-Sablon * America/Boa_Vista * America/Campo_Grande * America/Cuiaba * America/Curacao * America/Dominica * America/Glace_Bay * America/Goose_Bay * America/Grenada * America/Guadeloupe * America/Guyana * America/Halifax * America/Kralendijk * America/La_Paz * America/Lower_Princes * America/Manaus * America/Marigot * America/Martinique * America/Moncton * America/Montserrat * America/Port_of_Spain * America/Porto_Velho * America/Puerto_Rico * America/Santiago * America/Santo_Domingo * America/St_Barthelemy * America/St_Kitts * America/St_Lucia * America/St_Thomas * America/St_Vincent * America/Thule * America/Tortola * America/Virgin * Antarctica/Palmer * Atlantic/Bermuda * Brazil/West * Canada/Atlantic * Chile/Continental * Etc/GMT+4 * PRT * SystemV/AST4 * SystemV/AST4ADT * America/St_Johns * CNT * Canada/Newfoundland * AGT * America/Araguaina * America/Argentina/Buenos_Aires * America/Argentina/Catamarca * America/Argentina/ComodRivadavia * America/Argentina/Cordoba * America/Argentina/Jujuy * America/Argentina/La_Rioja * America/Argentina/Mendoza * America/Argentina/Rio_Gallegos * America/Argentina/Salta * America/Argentina/San_Juan * America/Argentina/San_Luis * America/Argentina/Tucuman * America/Argentina/Ushuaia * America/Bahia * America/Belem * America/Buenos_Aires * America/Catamarca * America/Cayenne * America/Cordoba * America/Fortaleza * America/Godthab * America/Jujuy * America/Maceio * America/Mendoza * America/Miquelon * America/Montevideo * America/Paramaribo * America/Recife * America/Rosario * America/Santarem * America/Sao_Paulo * Antarctica/Rothera * Atlantic/Stanley * BET * Brazil/East * Etc/GMT+3 * America/Noronha * Atlantic/South_Georgia * Brazil/DeNoronha * Etc/GMT+2 * America/Scoresbysund * Atlantic/Azores * Atlantic/Cape_Verde * Etc/GMT+1 * Africa/Abidjan * Africa/Accra * Africa/Bamako * Africa/Banjul * Africa/Bissau * Africa/Casablanca * Africa/Conakry * Africa/Dakar * Africa/El_Aaiun * Africa/Freetown * Africa/Lome * Africa/Monrovia * Africa/Nouakchott * Africa/Ouagadougou * Africa/Sao_Tome * Africa/Timbuktu * America/Danmarkshavn * Atlantic/Canary * Atlantic/Faeroe * Atlantic/Faroe * Atlantic/Madeira * Atlantic/Reykjavik * Atlantic/St_Helena * Eire * Etc/GMT * Etc/GMT+0 * Etc/GMT-0 * Etc/GMT0 * Etc/Greenwich * Etc/UCT * Etc/UTC * Etc/Universal * Etc/Zulu * Europe/Belfast * Europe/Dublin * Europe/Guernsey * Europe/Isle_of_Man * Europe/Jersey * Europe/Lisbon * Europe/London * GB * GB-Eire * GMT * GMT0 * Greenwich * Iceland * Portugal * UCT * UTC * Universal * WET * Zulu * Africa/Algiers * Africa/Bangui * Africa/Brazzaville * Africa/Ceuta * Africa/Douala * Africa/Kinshasa * Africa/Lagos * Africa/Libreville * Africa/Luanda * Africa/Malabo * Africa/Ndjamena * Africa/Niamey * Africa/Porto-Novo * Africa/Tunis * Africa/Windhoek * Arctic/Longyearbyen * Atlantic/Jan_Mayen * CET * ECT * Etc/GMT-1 * Europe/Amsterdam * Europe/Andorra * Europe/Belgrade * Europe/Berlin * Europe/Bratislava * Europe/Brussels * Europe/Budapest * Europe/Busingen * Europe/Copenhagen * Europe/Gibraltar * Europe/Ljubljana * Europe/Luxembourg * Europe/Madrid * Europe/Malta * Europe/Monaco * Europe/Oslo * Europe/Paris * Europe/Podgorica * Europe/Prague * Europe/Rome * Europe/San_Marino * Europe/Sarajevo * Europe/Skopje * Europe/Stockholm * Europe/Tirane * Europe/Vaduz * Europe/Vatican * Europe/Vienna * Europe/Warsaw * Europe/Zagreb * Europe/Zurich * MET * Poland * ART * Africa/Blantyre * Africa/Bujumbura * Africa/Cairo * Africa/Gaborone * Africa/Harare * Africa/Johannesburg * Africa/Kigali * Africa/Lubumbashi * Africa/Lusaka * Africa/Maputo * Africa/Maseru * Africa/Mbabane * Africa/Tripoli * Asia/Beirut * Asia/Damascus * Asia/Gaza * Asia/Hebron * Asia/Istanbul * Asia/Jerusalem * Asia/Nicosia * Asia/Tel_Aviv * CAT * EET * Egypt * Etc/GMT-2 * Europe/Athens * Europe/Bucharest * Europe/Chisinau * Europe/Helsinki * Europe/Istanbul * Europe/Kiev * Europe/Mariehamn * Europe/Nicosia * Europe/Riga * Europe/Simferopol * Europe/Sofia * Europe/Tallinn * Europe/Tiraspol * Europe/Uzhgorod * Europe/Vilnius * Europe/Zaporozhye * Israel * Libya * Turkey * Africa/Addis_Ababa * Africa/Asmara * Africa/Asmera * Africa/Dar_es_Salaam * Africa/Djibouti * Africa/Juba * Africa/Kampala * Africa/Khartoum * Africa/Mogadishu * Africa/Nairobi * Antarctica/Syowa * Asia/Aden * Asia/Amman * Asia/Baghdad * Asia/Bahrain * Asia/Kuwait * Asia/Qatar * Asia/Riyadh * EAT * Etc/GMT-3 * Europe/Kaliningrad * Europe/Minsk * Indian/Antananarivo * Indian/Comoro * Indian/Mayotte * Asia/Riyadh87 * Asia/Riyadh88 * Asia/Riyadh89 * Mideast/Riyadh87 * Mideast/Riyadh88 * Mideast/Riyadh89 * Asia/Tehran * Iran * Asia/Baku * Asia/Dubai * Asia/Muscat * Asia/Tbilisi * Asia/Yerevan * Etc/GMT-4 * Europe/Moscow * Europe/Samara * Europe/Volgograd * Indian/Mahe * Indian/Mauritius * Indian/Reunion * NET * W-SU * Asia/Kabul * Antarctica/Mawson * Asia/Aqtau * Asia/Aqtobe * Asia/Ashgabat * Asia/Ashkhabad * Asia/Dushanbe * Asia/Karachi * Asia/Oral * Asia/Samarkand * Asia/Tashkent * Etc/GMT-5 * Indian/Kerguelen * Indian/Maldives * PLT * Asia/Calcutta * Asia/Colombo * Asia/Kolkata * IST * Asia/Kathmandu * Asia/Katmandu * Antarctica/Vostok * Asia/Almaty * Asia/Bishkek * Asia/Dacca * Asia/Dhaka * Asia/Qyzylorda * Asia/Thimbu * Asia/Thimphu * Asia/Yekaterinburg * BST * Etc/GMT-6 * Indian/Chagos * Asia/Rangoon * Indian/Cocos * Antarctica/Davis * Asia/Bangkok * Asia/Ho_Chi_Minh * Asia/Hovd * Asia/Jakarta * Asia/Novokuznetsk * Asia/Novosibirsk * Asia/Omsk * Asia/Phnom_Penh * Asia/Pontianak * Asia/Saigon * Asia/Vientiane * Etc/GMT-7 * Indian/Christmas * VST * Antarctica/Casey * Asia/Brunei * Asia/Choibalsan * Asia/Chongqing * Asia/Chungking * Asia/Harbin * Asia/Hong_Kong * Asia/Kashgar * Asia/Krasnoyarsk * Asia/Kuala_Lumpur * Asia/Kuching * Asia/Macao * Asia/Macau * Asia/Makassar * Asia/Manila * Asia/Shanghai * Asia/Singapore * Asia/Taipei * Asia/Ujung_Pandang * Asia/Ulaanbaatar * Asia/Ulan_Bator * Asia/Urumqi * Australia/Perth * Australia/West * CTT * Etc/GMT-8 * Hongkong * PRC * Singapore * Australia/Eucla * Asia/Dili * Asia/Irkutsk * Asia/Jayapura * Asia/Pyongyang * Asia/Seoul * Asia/Tokyo * Etc/GMT-9 * JST * Japan * Pacific/Palau * ROK * ACT * Australia/Adelaide * Australia/Broken_Hill * Australia/Darwin * Australia/North * Australia/South * Australia/Yancowinna * AET * Antarctica/DumontDUrville * Asia/Khandyga * Asia/Yakutsk * Australia/ACT * Australia/Brisbane * Australia/Canberra * Australia/Currie * Australia/Hobart * Australia/Lindeman * Australia/Melbourne * Australia/NSW * Australia/Queensland * Australia/Sydney * Australia/Tasmania * Australia/Victoria * Etc/GMT-10 * Pacific/Chuuk * Pacific/Guam * Pacific/Port_Moresby * Pacific/Saipan * Pacific/Truk * Pacific/Yap * Australia/LHI * Australia/Lord_Howe * Antarctica/Macquarie * Asia/Sakhalin * Asia/Ust-Nera * Asia/Vladivostok * Etc/GMT-11 * Pacific/Efate * Pacific/Guadalcanal * Pacific/Kosrae * Pacific/Noumea * Pacific/Pohnpei * Pacific/Ponape * SST * Pacific/Norfolk * Antarctica/McMurdo * Antarctica/South_Pole * Asia/Anadyr * Asia/Kamchatka * Asia/Magadan * Etc/GMT-12 * Kwajalein * NST * NZ * Pacific/Auckland * Pacific/Fiji * Pacific/Funafuti * Pacific/Kwajalein * Pacific/Majuro * Pacific/Nauru * Pacific/Tarawa * Pacific/Wake * Pacific/Wallis * NZ-CHAT * Pacific/Chatham * Etc/GMT-13 * MIT * Pacific/Apia * Pacific/Enderbury * Pacific/Fakaofo * Pacific/Tongatapu * Etc/GMT-14 * Pacific/Kiritimati |
The Time Zone to use for formatting dates when performing a search. Only used with Managed time strategies. |
| Application | The Splunk Application to query. | ||
| Owner | The owner to pass to Splunk. | ||
| Token | The token to pass to Splunk. | ||
| Username | The username to authenticate to Splunk. | ||
| Password |
The password to authenticate to Splunk. Sensitive Property: true |
||
| Security Protocol | TLSv1_2 |
* TLSv1_2 * TLSv1_1 * TLSv1 * SSLv3 |
The security protocol to use for communicating with Splunk. |
| Output Mode | JSON |
* ATOM * CSV * JSON * JSON_COLS * JSON_ROWS * RAW * XML |
The output mode for the results. |
Relationships:
| Name | Description |
| success | Results retrieved from Splunk are sent out this relationship. |
Reads Attributes:
None specified.
Writes Attributes:
| Name | Description |
| splunk.query | The query that performed to produce the FlowFile. |
| splunk.earliest.time | The value of the earliest time that was used when performing the query. |
| splunk.latest.time | The value of the latest time that was used when performing the query. |