Grepr Splunk Integration API

openapi: 3.2.0
info:
  title: Grepr Splunk Integration API
  version: 1.0.0
  description: 'Operations tagged Splunk Integration across 2 of this provider''s published API definitions: grepr-openapi.json, grepr.json. Each path carries the servers of the definition it was published in.'
tags:
- description: ''
  name: Splunk Integration
paths:
  /v1/integrations/splunk:
    get:
      description: Get all Splunk integrations for your organization. This will contain masked keys if present.
      operationId: listSplunkIntegrations
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ItemsCollectionReadSplunk'
          description: Integrations retrieved successfully
        '401':
          description: Unauthorized
      security:
      - grepr-oidc: []
      summary: List all Splunk integrations
      tags:
      - Splunk Integration
    post:
      description: Creates an integration to connect to Splunk.
      operationId: createSplunkIntegration
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WriteSplunk'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReadSplunk'
          description: Integration created successfully
        '401':
          description: Unauthorized
        '409':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReadSplunk'
          description: Integration already exists.
      security:
      - grepr-oidc: []
      summary: Create a Splunk integration
      tags:
      - Splunk Integration
  /v1/integrations/splunk/{id}:
    delete:
      description: Deletes an integration to connect to Splunk. This will delete the associated keys as well. No-op if already deleted.
      operationId: deleteSplunkIntegration
      parameters:
      - in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Integration deleted successfully
        '401':
          description: Unauthorized
      security:
      - grepr-oidc: []
      summary: Delete a Splunk integration
      tags:
      - Splunk Integration
    get:
      description: Get an integration to connect to Splunk.
      operationId: getSplunkIntegration
      parameters:
      - in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReadSplunk'
          description: Integration retrieved successfully
        '401':
          description: Unauthorized
        '404':
          description: Integration not found.
      security:
      - grepr-oidc: []
      summary: Get a Splunk integration
      tags:
      - Splunk Integration
    put:
      description: Updates an integration to connect to Splunk. The version should be increased by one for every new update in order for the write to succeed. Otherwise, a '409 Conflict' will be returned.
      operationId: updateSplunkIntegration
      parameters:
      - in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WriteSplunk'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReadSplunk'
          description: Integration updated successfully
        '401':
          description: Unauthorized
        '404':
          description: Integration not found.
        '409':
          description: Integration was modified or deleted concurrently.
      security:
      - grepr-oidc: []
      summary: Update a Splunk integration
      tags:
      - Splunk Integration
  /v1/integrations/splunk/{id}/auth-token:
    put:
      description: Creates an HEC API auth token for a Splunk integration if it doesn't exist and updates it otherwise. If the key is updated while the integration is being used by a pipeline, the new key will be picked at pipeline restart, rescaling or an update. Ingestion supports the previous and the updated key for up to 24 hours of a key update. Make sure to change the key used by the agents to send data within 24 hours of an update for a seamless transition
      operationId: upsertSplunkAuthToken
      parameters:
      - in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecretApi'
      responses:
        '204':
          description: HEC API Auth token upserted successfully.
        '401':
          description: Unauthorized
        '404':
          description: Integration not found.
      security:
      - grepr-oidc: []
      summary: Creates or updates a Splunk integration auth token
      tags:
      - Splunk Integration
  /v1/integrations/splunk/{id}/exceptions:
    get:
      description: Returns a paginated list of vendor imported exceptions for the specified Splunk integration
      operationId: getSplunkIntegrationExceptions
      parameters:
      - description: Integration ID
        in: path
        name: id
        required: true
        schema:
          type: string
      - description: 'Page size (100-2000, default: 100)'
        in: query
        name: pageSize
        schema:
          default: 100
          format: int32
          maximum: 2000
          minimum: 100
          type: integer
      - description: 'Page number (0-based, default: 0)'
        in: query
        name: page
        schema:
          default: 0
          format: int32
          minimum: 0
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IntegrationExceptionsList'
          description: Successfully retrieved integration exceptions
        '401':
          description: Unauthorized
        '403':
          description: Access denied
        '404':
          description: Integration not found
      security:
      - grepr-oidc: []
      summary: Get Splunk integration exceptions
      tags:
      - Splunk Integration
  /v1/integrations/splunk/{id}/rest-auth-token:
    put:
      description: Creates a Splunk API auth token for a Splunk integration if it doesn't exist and updates it otherwise. If the token is updated while the integration is being used by a pipeline, the new token will be picked at pipeline restart, rescaling or an update. This token is used for the Splunk API to search and retrieve logs.
      operationId: upsertSplunkRestAuthToken
      parameters:
      - in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecretApi'
      responses:
        '204':
          description: Splunk REST API auth token upserted successfully.
        '401':
          description: Unauthorized
        '404':
          description: Integration not found.
      security:
      - grepr-oidc: []
      summary: Creates or updates a Splunk integration API auth token
      tags:
      - Splunk Integration
  /v1/integrations/splunk/{id}/with-exceptions:
    get:
      description: Get an integration to connect to Splunk with vendor imported exceptions populated.
      operationId: getSplunkIntegrationWithExceptions
      parameters:
      - in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReadSplunk'
          description: Integration retrieved successfully with exceptions
        '401':
          description: Unauthorized
        '404':
          description: Integration not found.
      security:
      - grepr-oidc: []
      summary: Get a Splunk integration with exceptions
      tags:
      - Splunk Integration
components:
  schemas:
    ReadSplunk:
      properties:
        createdAt:
          description: Timestamp when the integration was created.
          format: date-time
          readOnly: true
          type: string
        id:
          description: The integration id
          type: string
        jobIds:
          description: List of job IDs associated with the integration.
          items:
            description: List of job IDs associated with the integration.
            type: string
          type: array
          uniqueItems: true
        name:
          description: Name of the integration.
          example: my_integration
          pattern: '[a-zA-Z0-9 _-]{1,128}'
          type: string
        organizationId:
          description: Organization ID of the integration.
          type: string
        payload:
          $ref: '#/components/schemas/Splunk'
        teamIds:
          description: The team IDs that this integration is associated with.
          items:
            description: The team IDs that this integration is associated with.
            type: string
          type: array
          uniqueItems: true
        type:
          description: The type of the integration. This is used to determine the payload type.
          enum:
          - splunk
          type: string
        updatedAt:
          description: Timestamp when the integration was last updated.
          format: date-time
          readOnly: true
          type: string
        version:
          description: Version of the integration. Should be increased by one for every new update in order for the write to succeed. Otherwise, a '409 Conflict' will be returned.
          example: 0
          format: int32
          minimum: 0
          type: integer
      required:
      - createdAt
      - id
      - jobIds
      - name
      - organizationId
      - payload
      - type
      - updatedAt
      - version
      type: object
    DatadogQueryPredicate:
      properties:
        query:
          default: ''
          description: The datadog query used by the predicate. See https://docs.datadoghq.com/tracing/trace_explorer/query_syntax
          example: service:grepr-service-1
          type: string
        type:
          description: A predicate that checks if an event matches a datadog query.
          enum:
          - datadog-query
          type: string
      required:
      - query
      - type
      type: object
    IntegrationExceptionsList:
      description: Paginated list of vendor imported exceptions for an integration
      properties:
        exceptions:
          $ref: '#/components/schemas/ItemsCollectionVendorImportedException'
        hasMore:
          description: Whether there are more pages available
          type: boolean
        page:
          description: Current page number (0-based)
          format: int32
          type: integer
        pageSize:
          description: Number of items per page
          format: int32
          type: integer
      type: object
    WriteSplunk:
      properties:
        name:
          description: Name of the integration.
          example: my_integration
          pattern: '[a-zA-Z0-9 _-]{1,128}'
          type: string
        payload:
          $ref: '#/components/schemas/Splunk'
        teamIds:
          default: []
          description: The team IDs that this integration is associated with.
          items:
            description: The team IDs that this integration is associated with.
            type: string
          type: array
          uniqueItems: true
        type:
          description: The type of the integration. This is used to determine the payload type.
          enum:
          - splunk
          type: string
        version:
          description: Version of the integration. Should be increased by one for every new update in order for the write to succeed. Otherwise, a '409 Conflict' will be returned.
          example: 0
          format: int32
          minimum: 0
          type: integer
      required:
      - name
      - payload
      - type
      - version
      type: object
    NewRelicQueryPredicate:
      properties:
        query:
          default: ''
          description: 'The New Relic query used by the predicate. See https://docs.newrelic.com/docs/logs/ui-data/query-syntax-logs/ '
          example: service:grepr-service-1
          type: string
        type:
          description: A predicate that checks if an event matches a New Relic query.
          enum:
          - newrelic-query
          type: string
      required:
      - query
      - type
      type: object
    ItemsCollectionVendorImportedException:
      description: Collection of vendor imported exceptions
      properties:
        items:
          default: []
          items:
            $ref: '#/components/schemas/VendorImportedException'
          type: array
      type: object
    Splunk:
      description: The payload containing integration data.
      properties:
        additionalTags:
          default: []
          description: Tags to add when writing data to Splunk
          example:
          - tag1:value1
          - tag2:value2
          items:
            description: Tags to add when writing data to Splunk
            example: '["tag1:value1","tag2:value2"]'
            type: string
          maxItems: 10
          minItems: 0
          type: array
        authToken:
          description: Masked HEC REST Auth token for Splunk used for ingestion
          example: '**************ey'
          readOnly: true
          type: string
        exceptions:
          additionalProperties:
            $ref: '#/components/schemas/VendorImportedException'
          description: The imported exceptions from Splunk. This is a map from the vendor resource Id to the exception.
          readOnly: true
          type: object
        filterQuery:
          default: ''
          description: Filter to apply when reading any data from the Splunk API
          example: service:my-service
          maxLength: 1024
          minLength: 0
          type: string
        ingestHost:
          description: Splunk ingest host name or IP address for log ingestion by the sinkfor both HTTP Event Collector (HEC) and Splunk-to-Splunk (S2S) ingestion.Either of splunk host or this should be specified.
          example: splunkcloud.com
          maxLength: 255
          minLength: 0
          type: string
        ingestPort:
          default: '8088'
          description: Splunk ingest port
          example: '8088'
          type: string
        restAuthToken:
          description: Masked Splunk REST Auth token for Splunk used for search
          example: '**************ey'
          readOnly: true
          type: string
        restHost:
          description: 'Splunk REST API host name or IP address for splunk logs and alerts search.Either of splunk host or this should be specified. '
          example: splunkcloud.com
          maxLength: 255
          minLength: 0
          type: string
        restPort:
          default: '8089'
          description: Splunk REST port
          example: '8089'
          type: string
        secure:
          default: true
          description: Splunk collector uses a valid SSL certificate
          type: boolean
        splunkHost:
          description: Splunk host name or IP address. If specified, ingest, REST and web endpoints default to this host. Either of splunk host or advanced config with individual endpoints should be specified.
          example: splunkcloud.com
          maxLength: 255
          minLength: 0
          type: string
        webHost:
          description: Splunk web host name or IP address for linking to Splunk Web UI to view backfilled logsEither of splunk host or this should be specified.
          example: splunkcloud.com
          maxLength: 255
          minLength: 0
          type: string
        webPort:
          default: '443'
          description: Splunk web port
          example: '443'
          type: string
      required:
      - additionalTags
      - filterQuery
      type: object
      x-type:
        type: splunk
    ParseResult:
      properties:
        errorMessage:
          type: string
        parseable:
          type: boolean
      type: object
    VendorImportedException:
      description: Exception that was imported from a vendor integration like Datadog, Splunk etc.
      properties:
        accountGroup:
          description: Account group hash identifying the vendor account
          example: a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4
          readOnly: true
          type: string
        createdAt:
          format: date-time
          type: string
        eventPredicate:
          $ref: '#/components/schemas/EventPredicate'
        eventPredicateHash:
          description: Hash of the event predicate for deduplication
          example: d4c3b2a1f6e5d4c3b2a1f6e5d4c3b2a1
          readOnly: true
          type: string
        exceptionType:
          enum:
          - DATADOG_MONITOR
          - DATADOG_DASHBOARD
          - DATADOG_LOG_BASED_METRICS
          - SPLUNK_MONITOR
          - NEW_RELIC_MONITOR
          - NEW_RELIC_DASHBOARD
          type: string
        integrationId:
          type: string
        parseResult:
          $ref: '#/components/schemas/ParseResult'
        sourceUri:
          type: string
        updatedAt:
          format: date-time
          type: string
        vendorResourceId:
          type: string
        vendorResourceName:
          type: string
      readOnly: true
      required:
      - vendorResourceId
      type: object
    MetricEventPredicate:
      properties:
        filterTags:
          additionalProperties:
            default: {}
            description: The set of tags to query for. If unspecified, all tags are queried.
            example:
              env:
              - prod
              service:
              - my-app
            items:
              default: '{}'
              description: The set of tags to query for. If unspecified, all tags are queried.
              example: '{"service":["my-app"],"env":["prod"]}'
              type: string
            type: array
            uniqueItems: true
          default: {}
          description: The set of tags to query for. If unspecified, all tags are queried.
          example:
            env:
            - prod
            service:
            - my-app
          type: object
        metricNames:
          default: []
          description: The names of the metrics to query. Must not be empty.
          example:
          - cpu.load
          - cpu.utilization
          items:
            description: The names of the metrics to query. Must not be empty.
            example: '["cpu.load","cpu.utilization"]'
            type: string
          maxItems: 2147483647
          minItems: 1
          type: array
        query:
          type: string
        type:
          description: A predicate that checks if an event matches a metrics query.
          enum:
          - metric-predicate
          type: string
      required:
      - metricNames
      - query
      - type
      type: object
    SecretApi:
      description: Secret wrapper for API responses
      properties:
        secret:
          description: The secret value
          type: string
      required:
      - secret
      type: object
    EventPredicate:
      description: Predicate applied to rows before analytical aggregation.
      discriminator:
        mapping:
          and-predicate: '#/components/schemas/AndEventPredicate'
          datadog-query: '#/components/schemas/DatadogQueryPredicate'
          metric-predicate: '#/components/schemas/MetricEventPredicate'
          newrelic-query: '#/components/schemas/NewRelicQueryPredicate'
          nrql-query: '#/components/schemas/NrqlQueryPredicate'
        propertyName: type
      oneOf:
      - $ref: '#/components/schemas/AndEventPredicate'
      - $ref: '#/components/schemas/DatadogQueryPredicate'
      - $ref: '#/components/schemas/MetricEventPredicate'
      - $ref: '#/components/schemas/NewRelicQueryPredicate'
      - $ref: '#/components/schemas/NrqlQueryPredicate'
      properties:
        query:
          type: string
        type:
          type: string
      required:
      - type
      type: object
    ItemsCollectionReadSplunk:
      properties:
        items:
          default: []
          items:
            $ref: '#/components/schemas/ReadSplunk'
          type: array
      type: object
    AndEventPredicate:
      properties:
        queries:
          default: []
          description: List of predicates that must all match for this predicate to match.
          items:
            $ref: '#/components/schemas/EventPredicate'
          maxItems: 2147483647
          minItems: 1
          title: Child predicates
          type: array
        type:
          description: A predicate that matches when every child predicate matches.
          enum:
          - and-predicate
          type: string
      required:
      - queries
      - type
      type: object
    NrqlQueryPredicate:
      properties:
        query:
          default: ''
          description: The Nrql query used by the predicate. See https://docs.newrelic.com/docs/nrql
          example: SELECT * FROM Log WHERE service = 'grepr-service-1'
          type: string
        strict:
          default: true
          description: Whether the query should be parsed in strict mode.
          type: boolean
        type:
          description: A predicate that checks if an event matches an NRQL query.
          enum:
          - nrql-query
          type: string
      required:
      - query
      - type
      type: object
  securitySchemes:
    grepr-api-key:
      in: header
      name: GREPR-API-KEY
      type: apiKey
    grepr-oidc:
      bearerFormat: JWT
      openIdConnectUrl: https://grepr-prod.us.auth0.com/.well-known/openid-configuration
      type: openIdConnect
x-refined-from:
- grepr-openapi.json
- grepr.json
x-tagGroups:
- name: Integrations
  tags:
  - Grepr-hosted Data Warehouse Integration
  - External S3 Data Warehouse Integration
  - Datadog Integration
  - New Relic Integration
  - Splunk Integration
  - Sumo Logic Integration
  - OpenTelemetry Integration
- name: Pipelines
  tags:
  - Jobs
  - Templates
  - Datasets
  - Status Metrics
  - External Triggers
  - Job Actions
  - Triggers
- name: Pipeline Components
  tags:
  - Operations
  - Transforms
  - Sources
  - Sinks
- name: Administration
  tags:
  - Users
  - Teams
  - Roles
  - Permission
  - Invitations
  - Activity Logs
- name: Organization
  tags:
  - Organizations
  - Access Configuration
  - Grepr API Key
  - Service Accounts
  - Signup
- name: Query & Analysis
  tags:
  - Job Anomalies
  - Grok Parsing
  - Query Parsing
  - Validation
- name: System
  tags:
  - Manifest