| <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"></meta><title>GetSplunk</title><link rel="stylesheet" href="../../../../../css/component-usage.css" type="text/css"></link></head><script type="text/javascript">window.onload = function(){if(self==top) { document.getElementById('nameHeader').style.display = "inherit"; } }</script><body><h1 id="nameHeader" style="display: none;">GetSplunk</h1><h2>Description: </h2><p>Retrieves data from Splunk Enterprise.</p><h3>Tags: </h3><p>get, splunk, logs</p><h3>Properties: </h3><p>In the list below, the names of required properties appear in <strong>bold</strong>. Any other properties (not in bold) are considered optional. The table also indicates any default values.</p><table id="properties"><tr><th>Display Name</th><th>API Name</th><th>Default Value</th><th>Allowable Values</th><th>Description</th></tr><tr><td id="name"><strong>Scheme</strong></td><td>Scheme</td><td id="default-value">https</td><td id="allowable-values"><ul><li>https</li><li>http</li></ul></td><td id="description">The scheme for connecting to Splunk.</td></tr><tr><td id="name"><strong>Hostname</strong></td><td>Hostname</td><td id="default-value">localhost</td><td id="allowable-values"></td><td id="description">The ip address or hostname of the Splunk server.</td></tr><tr><td id="name"><strong>Port</strong></td><td>Port</td><td id="default-value">8089</td><td id="allowable-values"></td><td id="description">The port of the Splunk server.</td></tr><tr><td id="name">Connection Timeout</td><td>Connection Timeout</td><td id="default-value">5 secs</td><td id="allowable-values"></td><td id="description">Max wait time for connection to the Splunk server.</td></tr><tr><td id="name">Read Timeout</td><td>Read Timeout</td><td id="default-value">15 secs</td><td id="allowable-values"></td><td id="description">Max wait time for response from the Splunk server.</td></tr><tr><td id="name"><strong>Query</strong></td><td>Query</td><td id="default-value">search * | head 100</td><td id="allowable-values"></td><td id="description">The query to execute. Typically beginning with a <search> command followed by a search clause, such as <search source="tcp:7689"> to search for messages received on TCP port 7689.</td></tr><tr><td id="name"><strong>Time Field Strategy</strong></td><td>Time Field Strategy</td><td id="default-value">Event Time</td><td id="allowable-values"><ul><li>Event Time <img src="../../../../../html/images/iconInfo.png" alt="Search based on the time of the event which may be different than when the event was indexed." title="Search based on the time of the event which may be different than when the event was indexed."></img></li><li>Index Time <img src="../../../../../html/images/iconInfo.png" alt="Search based on the time the event was indexed in Splunk." title="Search based on the time the event was indexed in Splunk."></img></li></ul></td><td id="description">Indicates whether to search by the time attached to the event, or by the time the event was indexed in Splunk.</td></tr><tr><td id="name"><strong>Time Range Strategy</strong></td><td>Time Range Strategy</td><td id="default-value">Provided</td><td id="allowable-values"><ul><li>Managed from Beginning <img src="../../../../../html/images/iconInfo.png" alt="The processor will manage the date ranges of the query starting from the beginning of time." title="The processor will manage the date ranges of the query starting from the beginning of time."></img></li><li>Managed from Current <img src="../../../../../html/images/iconInfo.png" alt="The processor will manage the date ranges of the query starting from the current time." title="The processor will manage the date ranges of the query starting from the current time."></img></li><li>Provided <img src="../../../../../html/images/iconInfo.png" alt="The the time range provided through the Earliest Time and Latest Time properties will be used." title="The the time range provided through the Earliest Time and Latest Time properties will be used."></img></li></ul></td><td id="description">Indicates how to apply time ranges to each execution of the query. Selecting a managed option allows the processor to apply a time range from the last execution time to the current execution time. When using <Managed from Beginning>, an earliest time will not be applied on the first execution, and thus all records searched. When using <Managed from Current> the earliest time of the first execution will be the initial execution time. When using <Provided>, the time range will come from the Earliest Time and Latest Time properties, or no time range will be applied if these properties are left blank.</td></tr><tr><td id="name">Earliest Time</td><td>Earliest Time</td><td></td><td id="allowable-values"></td><td id="description">The value to use for the earliest time when querying. Only used with a Time Range Strategy of Provided. See Splunk's documentation on Search Time Modifiers for guidance in populating this field.</td></tr><tr><td id="name">Latest Time</td><td>Latest Time</td><td></td><td id="allowable-values"></td><td id="description">The value to use for the latest time when querying. Only used with a Time Range Strategy of Provided. See Splunk's documentation on Search Time Modifiers for guidance in populating this field.</td></tr><tr><td id="name"><strong>Time Zone</strong></td><td>Time Zone</td><td id="default-value">UTC</td><td id="allowable-values"><ul><li>Africa/Abidjan</li><li>Africa/Accra</li><li>Africa/Addis_Ababa</li><li>Africa/Algiers</li><li>Africa/Asmara</li><li>Africa/Asmera</li><li>Africa/Bamako</li><li>Africa/Bangui</li><li>Africa/Banjul</li><li>Africa/Bissau</li><li>Africa/Blantyre</li><li>Africa/Brazzaville</li><li>Africa/Bujumbura</li><li>Africa/Cairo</li><li>Africa/Casablanca</li><li>Africa/Ceuta</li><li>Africa/Conakry</li><li>Africa/Dakar</li><li>Africa/Dar_es_Salaam</li><li>Africa/Djibouti</li><li>Africa/Douala</li><li>Africa/El_Aaiun</li><li>Africa/Freetown</li><li>Africa/Gaborone</li><li>Africa/Harare</li><li>Africa/Johannesburg</li><li>Africa/Juba</li><li>Africa/Kampala</li><li>Africa/Khartoum</li><li>Africa/Kigali</li><li>Africa/Kinshasa</li><li>Africa/Lagos</li><li>Africa/Libreville</li><li>Africa/Lome</li><li>Africa/Luanda</li><li>Africa/Lubumbashi</li><li>Africa/Lusaka</li><li>Africa/Malabo</li><li>Africa/Maputo</li><li>Africa/Maseru</li><li>Africa/Mbabane</li><li>Africa/Mogadishu</li><li>Africa/Monrovia</li><li>Africa/Nairobi</li><li>Africa/Ndjamena</li><li>Africa/Niamey</li><li>Africa/Nouakchott</li><li>Africa/Ouagadougou</li><li>Africa/Porto-Novo</li><li>Africa/Sao_Tome</li><li>Africa/Timbuktu</li><li>Africa/Tripoli</li><li>Africa/Tunis</li><li>Africa/Windhoek</li><li>America/Adak</li><li>America/Anchorage</li><li>America/Anguilla</li><li>America/Antigua</li><li>America/Araguaina</li><li>America/Argentina/Buenos_Aires</li><li>America/Argentina/Catamarca</li><li>America/Argentina/ComodRivadavia</li><li>America/Argentina/Cordoba</li><li>America/Argentina/Jujuy</li><li>America/Argentina/La_Rioja</li><li>America/Argentina/Mendoza</li><li>America/Argentina/Rio_Gallegos</li><li>America/Argentina/Salta</li><li>America/Argentina/San_Juan</li><li>America/Argentina/San_Luis</li><li>America/Argentina/Tucuman</li><li>America/Argentina/Ushuaia</li><li>America/Aruba</li><li>America/Asuncion</li><li>America/Atikokan</li><li>America/Atka</li><li>America/Bahia</li><li>America/Bahia_Banderas</li><li>America/Barbados</li><li>America/Belem</li><li>America/Belize</li><li>America/Blanc-Sablon</li><li>America/Boa_Vista</li><li>America/Bogota</li><li>America/Boise</li><li>America/Buenos_Aires</li><li>America/Cambridge_Bay</li><li>America/Campo_Grande</li><li>America/Cancun</li><li>America/Caracas</li><li>America/Catamarca</li><li>America/Cayenne</li><li>America/Cayman</li><li>America/Chicago</li><li>America/Chihuahua</li><li>America/Coral_Harbour</li><li>America/Cordoba</li><li>America/Costa_Rica</li><li>America/Creston</li><li>America/Cuiaba</li><li>America/Curacao</li><li>America/Danmarkshavn</li><li>America/Dawson</li><li>America/Dawson_Creek</li><li>America/Denver</li><li>America/Detroit</li><li>America/Dominica</li><li>America/Edmonton</li><li>America/Eirunepe</li><li>America/El_Salvador</li><li>America/Ensenada</li><li>America/Fort_Nelson</li><li>America/Fort_Wayne</li><li>America/Fortaleza</li><li>America/Glace_Bay</li><li>America/Godthab</li><li>America/Goose_Bay</li><li>America/Grand_Turk</li><li>America/Grenada</li><li>America/Guadeloupe</li><li>America/Guatemala</li><li>America/Guayaquil</li><li>America/Guyana</li><li>America/Halifax</li><li>America/Havana</li><li>America/Hermosillo</li><li>America/Indiana/Indianapolis</li><li>America/Indiana/Knox</li><li>America/Indiana/Marengo</li><li>America/Indiana/Petersburg</li><li>America/Indiana/Tell_City</li><li>America/Indiana/Vevay</li><li>America/Indiana/Vincennes</li><li>America/Indiana/Winamac</li><li>America/Indianapolis</li><li>America/Inuvik</li><li>America/Iqaluit</li><li>America/Jamaica</li><li>America/Jujuy</li><li>America/Juneau</li><li>America/Kentucky/Louisville</li><li>America/Kentucky/Monticello</li><li>America/Knox_IN</li><li>America/Kralendijk</li><li>America/La_Paz</li><li>America/Lima</li><li>America/Los_Angeles</li><li>America/Louisville</li><li>America/Lower_Princes</li><li>America/Maceio</li><li>America/Managua</li><li>America/Manaus</li><li>America/Marigot</li><li>America/Martinique</li><li>America/Matamoros</li><li>America/Mazatlan</li><li>America/Mendoza</li><li>America/Menominee</li><li>America/Merida</li><li>America/Metlakatla</li><li>America/Mexico_City</li><li>America/Miquelon</li><li>America/Moncton</li><li>America/Monterrey</li><li>America/Montevideo</li><li>America/Montreal</li><li>America/Montserrat</li><li>America/Nassau</li><li>America/New_York</li><li>America/Nipigon</li><li>America/Nome</li><li>America/Noronha</li><li>America/North_Dakota/Beulah</li><li>America/North_Dakota/Center</li><li>America/North_Dakota/New_Salem</li><li>America/Nuuk</li><li>America/Ojinaga</li><li>America/Panama</li><li>America/Pangnirtung</li><li>America/Paramaribo</li><li>America/Phoenix</li><li>America/Port-au-Prince</li><li>America/Port_of_Spain</li><li>America/Porto_Acre</li><li>America/Porto_Velho</li><li>America/Puerto_Rico</li><li>America/Punta_Arenas</li><li>America/Rainy_River</li><li>America/Rankin_Inlet</li><li>America/Recife</li><li>America/Regina</li><li>America/Resolute</li><li>America/Rio_Branco</li><li>America/Rosario</li><li>America/Santa_Isabel</li><li>America/Santarem</li><li>America/Santiago</li><li>America/Santo_Domingo</li><li>America/Sao_Paulo</li><li>America/Scoresbysund</li><li>America/Shiprock</li><li>America/Sitka</li><li>America/St_Barthelemy</li><li>America/St_Johns</li><li>America/St_Kitts</li><li>America/St_Lucia</li><li>America/St_Thomas</li><li>America/St_Vincent</li><li>America/Swift_Current</li><li>America/Tegucigalpa</li><li>America/Thule</li><li>America/Thunder_Bay</li><li>America/Tijuana</li><li>America/Toronto</li><li>America/Tortola</li><li>America/Vancouver</li><li>America/Virgin</li><li>America/Whitehorse</li><li>America/Winnipeg</li><li>America/Yakutat</li><li>America/Yellowknife</li><li>Antarctica/Casey</li><li>Antarctica/Davis</li><li>Antarctica/DumontDUrville</li><li>Antarctica/Macquarie</li><li>Antarctica/Mawson</li><li>Antarctica/McMurdo</li><li>Antarctica/Palmer</li><li>Antarctica/Rothera</li><li>Antarctica/South_Pole</li><li>Antarctica/Syowa</li><li>Antarctica/Troll</li><li>Antarctica/Vostok</li><li>Arctic/Longyearbyen</li><li>Asia/Aden</li><li>Asia/Almaty</li><li>Asia/Amman</li><li>Asia/Anadyr</li><li>Asia/Aqtau</li><li>Asia/Aqtobe</li><li>Asia/Ashgabat</li><li>Asia/Ashkhabad</li><li>Asia/Atyrau</li><li>Asia/Baghdad</li><li>Asia/Bahrain</li><li>Asia/Baku</li><li>Asia/Bangkok</li><li>Asia/Barnaul</li><li>Asia/Beirut</li><li>Asia/Bishkek</li><li>Asia/Brunei</li><li>Asia/Calcutta</li><li>Asia/Chita</li><li>Asia/Choibalsan</li><li>Asia/Chongqing</li><li>Asia/Chungking</li><li>Asia/Colombo</li><li>Asia/Dacca</li><li>Asia/Damascus</li><li>Asia/Dhaka</li><li>Asia/Dili</li><li>Asia/Dubai</li><li>Asia/Dushanbe</li><li>Asia/Famagusta</li><li>Asia/Gaza</li><li>Asia/Harbin</li><li>Asia/Hebron</li><li>Asia/Ho_Chi_Minh</li><li>Asia/Hong_Kong</li><li>Asia/Hovd</li><li>Asia/Irkutsk</li><li>Asia/Istanbul</li><li>Asia/Jakarta</li><li>Asia/Jayapura</li><li>Asia/Jerusalem</li><li>Asia/Kabul</li><li>Asia/Kamchatka</li><li>Asia/Karachi</li><li>Asia/Kashgar</li><li>Asia/Kathmandu</li><li>Asia/Katmandu</li><li>Asia/Khandyga</li><li>Asia/Kolkata</li><li>Asia/Krasnoyarsk</li><li>Asia/Kuala_Lumpur</li><li>Asia/Kuching</li><li>Asia/Kuwait</li><li>Asia/Macao</li><li>Asia/Macau</li><li>Asia/Magadan</li><li>Asia/Makassar</li><li>Asia/Manila</li><li>Asia/Muscat</li><li>Asia/Nicosia</li><li>Asia/Novokuznetsk</li><li>Asia/Novosibirsk</li><li>Asia/Omsk</li><li>Asia/Oral</li><li>Asia/Phnom_Penh</li><li>Asia/Pontianak</li><li>Asia/Pyongyang</li><li>Asia/Qatar</li><li>Asia/Qostanay</li><li>Asia/Qyzylorda</li><li>Asia/Rangoon</li><li>Asia/Riyadh</li><li>Asia/Saigon</li><li>Asia/Sakhalin</li><li>Asia/Samarkand</li><li>Asia/Seoul</li><li>Asia/Shanghai</li><li>Asia/Singapore</li><li>Asia/Srednekolymsk</li><li>Asia/Taipei</li><li>Asia/Tashkent</li><li>Asia/Tbilisi</li><li>Asia/Tehran</li><li>Asia/Tel_Aviv</li><li>Asia/Thimbu</li><li>Asia/Thimphu</li><li>Asia/Tokyo</li><li>Asia/Tomsk</li><li>Asia/Ujung_Pandang</li><li>Asia/Ulaanbaatar</li><li>Asia/Ulan_Bator</li><li>Asia/Urumqi</li><li>Asia/Ust-Nera</li><li>Asia/Vientiane</li><li>Asia/Vladivostok</li><li>Asia/Yakutsk</li><li>Asia/Yangon</li><li>Asia/Yekaterinburg</li><li>Asia/Yerevan</li><li>Atlantic/Azores</li><li>Atlantic/Bermuda</li><li>Atlantic/Canary</li><li>Atlantic/Cape_Verde</li><li>Atlantic/Faeroe</li><li>Atlantic/Faroe</li><li>Atlantic/Jan_Mayen</li><li>Atlantic/Madeira</li><li>Atlantic/Reykjavik</li><li>Atlantic/South_Georgia</li><li>Atlantic/St_Helena</li><li>Atlantic/Stanley</li><li>Australia/ACT</li><li>Australia/Adelaide</li><li>Australia/Brisbane</li><li>Australia/Broken_Hill</li><li>Australia/Canberra</li><li>Australia/Currie</li><li>Australia/Darwin</li><li>Australia/Eucla</li><li>Australia/Hobart</li><li>Australia/LHI</li><li>Australia/Lindeman</li><li>Australia/Lord_Howe</li><li>Australia/Melbourne</li><li>Australia/NSW</li><li>Australia/North</li><li>Australia/Perth</li><li>Australia/Queensland</li><li>Australia/South</li><li>Australia/Sydney</li><li>Australia/Tasmania</li><li>Australia/Victoria</li><li>Australia/West</li><li>Australia/Yancowinna</li><li>Brazil/Acre</li><li>Brazil/DeNoronha</li><li>Brazil/East</li><li>Brazil/West</li><li>CET</li><li>CST6CDT</li><li>Canada/Atlantic</li><li>Canada/Central</li><li>Canada/Eastern</li><li>Canada/Mountain</li><li>Canada/Newfoundland</li><li>Canada/Pacific</li><li>Canada/Saskatchewan</li><li>Canada/Yukon</li><li>Chile/Continental</li><li>Chile/EasterIsland</li><li>Cuba</li><li>EET</li><li>EST5EDT</li><li>Egypt</li><li>Eire</li><li>Etc/GMT</li><li>Etc/GMT+0</li><li>Etc/GMT+1</li><li>Etc/GMT+10</li><li>Etc/GMT+11</li><li>Etc/GMT+12</li><li>Etc/GMT+2</li><li>Etc/GMT+3</li><li>Etc/GMT+4</li><li>Etc/GMT+5</li><li>Etc/GMT+6</li><li>Etc/GMT+7</li><li>Etc/GMT+8</li><li>Etc/GMT+9</li><li>Etc/GMT-0</li><li>Etc/GMT-1</li><li>Etc/GMT-10</li><li>Etc/GMT-11</li><li>Etc/GMT-12</li><li>Etc/GMT-13</li><li>Etc/GMT-14</li><li>Etc/GMT-2</li><li>Etc/GMT-3</li><li>Etc/GMT-4</li><li>Etc/GMT-5</li><li>Etc/GMT-6</li><li>Etc/GMT-7</li><li>Etc/GMT-8</li><li>Etc/GMT-9</li><li>Etc/GMT0</li><li>Etc/Greenwich</li><li>Etc/UCT</li><li>Etc/UTC</li><li>Etc/Universal</li><li>Etc/Zulu</li><li>Europe/Amsterdam</li><li>Europe/Andorra</li><li>Europe/Astrakhan</li><li>Europe/Athens</li><li>Europe/Belfast</li><li>Europe/Belgrade</li><li>Europe/Berlin</li><li>Europe/Bratislava</li><li>Europe/Brussels</li><li>Europe/Bucharest</li><li>Europe/Budapest</li><li>Europe/Busingen</li><li>Europe/Chisinau</li><li>Europe/Copenhagen</li><li>Europe/Dublin</li><li>Europe/Gibraltar</li><li>Europe/Guernsey</li><li>Europe/Helsinki</li><li>Europe/Isle_of_Man</li><li>Europe/Istanbul</li><li>Europe/Jersey</li><li>Europe/Kaliningrad</li><li>Europe/Kiev</li><li>Europe/Kirov</li><li>Europe/Lisbon</li><li>Europe/Ljubljana</li><li>Europe/London</li><li>Europe/Luxembourg</li><li>Europe/Madrid</li><li>Europe/Malta</li><li>Europe/Mariehamn</li><li>Europe/Minsk</li><li>Europe/Monaco</li><li>Europe/Moscow</li><li>Europe/Nicosia</li><li>Europe/Oslo</li><li>Europe/Paris</li><li>Europe/Podgorica</li><li>Europe/Prague</li><li>Europe/Riga</li><li>Europe/Rome</li><li>Europe/Samara</li><li>Europe/San_Marino</li><li>Europe/Sarajevo</li><li>Europe/Saratov</li><li>Europe/Simferopol</li><li>Europe/Skopje</li><li>Europe/Sofia</li><li>Europe/Stockholm</li><li>Europe/Tallinn</li><li>Europe/Tirane</li><li>Europe/Tiraspol</li><li>Europe/Ulyanovsk</li><li>Europe/Uzhgorod</li><li>Europe/Vaduz</li><li>Europe/Vatican</li><li>Europe/Vienna</li><li>Europe/Vilnius</li><li>Europe/Volgograd</li><li>Europe/Warsaw</li><li>Europe/Zagreb</li><li>Europe/Zaporozhye</li><li>Europe/Zurich</li><li>GB</li><li>GB-Eire</li><li>GMT</li><li>GMT0</li><li>Greenwich</li><li>Hongkong</li><li>Iceland</li><li>Indian/Antananarivo</li><li>Indian/Chagos</li><li>Indian/Christmas</li><li>Indian/Cocos</li><li>Indian/Comoro</li><li>Indian/Kerguelen</li><li>Indian/Mahe</li><li>Indian/Maldives</li><li>Indian/Mauritius</li><li>Indian/Mayotte</li><li>Indian/Reunion</li><li>Iran</li><li>Israel</li><li>Jamaica</li><li>Japan</li><li>Kwajalein</li><li>Libya</li><li>MET</li><li>MST7MDT</li><li>Mexico/BajaNorte</li><li>Mexico/BajaSur</li><li>Mexico/General</li><li>NZ</li><li>NZ-CHAT</li><li>Navajo</li><li>PRC</li><li>PST8PDT</li><li>Pacific/Apia</li><li>Pacific/Auckland</li><li>Pacific/Bougainville</li><li>Pacific/Chatham</li><li>Pacific/Chuuk</li><li>Pacific/Easter</li><li>Pacific/Efate</li><li>Pacific/Enderbury</li><li>Pacific/Fakaofo</li><li>Pacific/Fiji</li><li>Pacific/Funafuti</li><li>Pacific/Galapagos</li><li>Pacific/Gambier</li><li>Pacific/Guadalcanal</li><li>Pacific/Guam</li><li>Pacific/Honolulu</li><li>Pacific/Johnston</li><li>Pacific/Kanton</li><li>Pacific/Kiritimati</li><li>Pacific/Kosrae</li><li>Pacific/Kwajalein</li><li>Pacific/Majuro</li><li>Pacific/Marquesas</li><li>Pacific/Midway</li><li>Pacific/Nauru</li><li>Pacific/Niue</li><li>Pacific/Norfolk</li><li>Pacific/Noumea</li><li>Pacific/Pago_Pago</li><li>Pacific/Palau</li><li>Pacific/Pitcairn</li><li>Pacific/Pohnpei</li><li>Pacific/Ponape</li><li>Pacific/Port_Moresby</li><li>Pacific/Rarotonga</li><li>Pacific/Saipan</li><li>Pacific/Samoa</li><li>Pacific/Tahiti</li><li>Pacific/Tarawa</li><li>Pacific/Tongatapu</li><li>Pacific/Truk</li><li>Pacific/Wake</li><li>Pacific/Wallis</li><li>Pacific/Yap</li><li>Poland</li><li>Portugal</li><li>ROK</li><li>Singapore</li><li>SystemV/AST4</li><li>SystemV/AST4ADT</li><li>SystemV/CST6</li><li>SystemV/CST6CDT</li><li>SystemV/EST5</li><li>SystemV/EST5EDT</li><li>SystemV/HST10</li><li>SystemV/MST7</li><li>SystemV/MST7MDT</li><li>SystemV/PST8</li><li>SystemV/PST8PDT</li><li>SystemV/YST9</li><li>SystemV/YST9YDT</li><li>Turkey</li><li>UCT</li><li>US/Alaska</li><li>US/Aleutian</li><li>US/Arizona</li><li>US/Central</li><li>US/East-Indiana</li><li>US/Eastern</li><li>US/Hawaii</li><li>US/Indiana-Starke</li><li>US/Michigan</li><li>US/Mountain</li><li>US/Pacific</li><li>US/Samoa</li><li>UTC</li><li>Universal</li><li>W-SU</li><li>WET</li><li>Zulu</li><li>EST</li><li>HST</li><li>MST</li><li>ACT</li><li>AET</li><li>AGT</li><li>ART</li><li>AST</li><li>BET</li><li>BST</li><li>CAT</li><li>CNT</li><li>CST</li><li>CTT</li><li>EAT</li><li>ECT</li><li>IET</li><li>IST</li><li>JST</li><li>MIT</li><li>NET</li><li>NST</li><li>PLT</li><li>PNT</li><li>PRT</li><li>PST</li><li>SST</li><li>VST</li></ul></td><td id="description">The Time Zone to use for formatting dates when performing a search. Only used with Managed time strategies.</td></tr><tr><td id="name">Application</td><td>Application</td><td></td><td id="allowable-values"></td><td id="description">The Splunk Application to query.</td></tr><tr><td id="name">Owner</td><td>Owner</td><td></td><td id="allowable-values"></td><td id="description">The owner to pass to Splunk.</td></tr><tr><td id="name">Token</td><td>Token</td><td></td><td id="allowable-values"></td><td id="description">The token to pass to Splunk.</td></tr><tr><td id="name">Username</td><td>Username</td><td></td><td id="allowable-values"></td><td id="description">The username to authenticate to Splunk.</td></tr><tr><td id="name">Password</td><td>Password</td><td></td><td id="allowable-values"></td><td id="description">The password to authenticate to Splunk.<br/><strong>Sensitive Property: true</strong></td></tr><tr><td id="name">Security Protocol</td><td>Security Protocol</td><td id="default-value">TLSv1_2</td><td id="allowable-values"><ul><li>TLSv1_2</li><li>TLSv1_1</li><li>TLSv1</li><li>SSLv3</li></ul></td><td id="description">The security protocol to use for communicating with Splunk.</td></tr><tr><td id="name"><strong>Output Mode</strong></td><td>Output Mode</td><td id="default-value">JSON</td><td id="allowable-values"><ul><li>ATOM</li><li>CSV</li><li>JSON</li><li>JSON_COLS</li><li>JSON_ROWS</li><li>RAW</li><li>XML</li></ul></td><td id="description">The output mode for the results.</td></tr></table><h3>Relationships: </h3><table id="relationships"><tr><th>Name</th><th>Description</th></tr><tr><td>success</td><td>Results retrieved from Splunk are sent out this relationship.</td></tr></table><h3>Reads Attributes: </h3>None specified.<h3>Writes Attributes: </h3><table id="writes-attributes"><tr><th>Name</th><th>Description</th></tr><tr><td>splunk.query</td><td>The query that performed to produce the FlowFile.</td></tr><tr><td>splunk.earliest.time</td><td>The value of the earliest time that was used when performing the query.</td></tr><tr><td>splunk.latest.time</td><td>The value of the latest time that was used when performing the query.</td></tr></table><h3>State management: </h3><table id="stateful"><tr><th>Scope</th><th>Description</th></tr><tr><td>CLUSTER</td><td>If using one of the managed Time Range Strategies, this processor will store the values of the latest and earliest times from the previous execution so that the next execution of the can pick up where the last execution left off. The state will be cleared and start over if the query is changed.</td></tr></table><h3>Restricted: </h3>This component is not restricted.<h3>Input requirement: </h3>This component does not allow an incoming relationship.<h3>System Resource Considerations:</h3>None specified.</body></html> |