Splunk

Splunk is a data platform that enables organizations to search, monitor, analyze, and visualize massive streams of machine-generated data across security, observability, and AI use cases. It offers solutions for security information and event management (SIEM), infrastructure monitoring, application performance monitoring, and AI-driven analytics, helping enterprises turn data into actionable insights and operational intelligence.

Splunk publishes 14 API contracts indexed on the APIs.io network, including Data Inputs API, Index API, Search API, and 11 more. Tagged areas include Analytics, Data Analysis, Logging, Machine Data, and Monitoring.

The Splunk catalog on APIs.io includes 2 JSON-LD contexts and 3 Spectral governance rulesets.

Splunk’s developer surface includes signup flow, API reference, authentication, engineering blog, support, documentation, getting-started guide, and 76 more developer resources.

🌐 Visit website 📡 Profile data on GitHub

59.2/100 strong ▬ flat Agent 53/100 agent ready Front door AI 6/6 dominant open core · Apache-2.0 Full breakdown ↓
scored 2026-10-17 · rubric v0.24.0

AccessFreeSelf serve⚡ Free to try

1 published contract 1 MCP Servers 8 Features 6 Use Cases

Analytics Data Analysis Logging Machine Data Monitoring Observability Platform Security SIEM

What this lets a business do 1

Business capabilities this provider's published APIs can perform, derived from its own contracts. Browse all capabilities →

SaaS Platform Operations Management

BC-4220

GET /services/search/jobs POST /services/search/jobs GET /services/search/jobs/{search_id} GET /services/search/jobs/{search_id}/events

Kin Score

Kin Score How this is scored →
scored 2026-10-17 · rubric v0.24.0

Composite quality — 59.2/100 · strong

Contract Quality 10.9 / 16

Developer Ergonomics 8.7 / 13

Access Clarity 8.9 / 13

Operational Transparency 2.9 / 8

Contract Governance 2.5 / 8

Discoverability 4.3 / 7

Regulatory Posture 5.3 / 15

Open Source Surface 4.0 / 10

Create-or-Update Ergonomics 0.0 / 10

Agent readiness — 53/100 · agent ready

Machine-Readable Contract 18 / 18

Agentic Access Contract 10 / 10

Documented Reversibility 0 / 6

MCP Server 0 / 12

Machine-Readable Auth 10 / 10

Idempotency 0 / 9

Stable Error Semantics 8 / 8

Request/Response Examples 7 / 7

Rate-Limit Signaling 7 / 7

Typed Event Surface 0 / 6

Agent Skills 5 / 5

Well-Known Catalog 4 / 4

Consent & Bot Identity 0 / 3

A2A Agent Card 8 / 8

Dry-Run / Simulate Mode 0 / 4

Delegated User Identity 6 / 6

Protected Resource Metadata 5 / 5

Registration Without a Human 6 / 6

Agentic Commerce Well-Known Document 0 / 5

Regulatory Posture applies to this provider. Its tags matched the Horizontal (data, software, accessibility, platform) regime, so Regulatory Posture carries 15 points of the composite. If this regime is wrong for your business, say so on your provider repo — the applicability map is public and we will correct it.

Open Source Surface applies to this provider. This product is open source and we read its repository directly, so Open Source Surface carries 10 points of the composite. It is scored from what the repository actually publishes — a security policy, a contribution guide, a release history, a code of conduct — read live from the provider rather than inferred from our own catalog pointers. This facet adds; nothing was taken away to make room for it. An open-source project is not excused from the commercial facets, because exemption would strip it of the points it does earn. If we have the wrong repository, or this product is not open source, say so on your provider repo and we will drop the facet rather than have you publish against it.

Create-or-Update Ergonomics applies to this provider. This API accepts writes, so it carries 10 points of the composite. It is scored from the published contracts themselves: whether a caller can create-or-update in one call, whether the write accepts a key the caller already holds, and whether the response says which branch ran. Without that, every write needs a search-and-branch in front of it, and the first time that check is skipped a duplicate record is created. Scored against the observed mean rather than raw — a provider at the catalog average is unchanged by this facet, not penalised by it.

The six quality facets above are damped to 65 points between them, because both conditional facets apply and carry 35 points together. That is why each facet's contribution is shown against a damped maximum: raising a quality facet moves the composite by 65% of its nominal weight, not 100%. The full arithmetic is at apis.io/rating/.

Improve this rating by publishing the missing artifacts — every area above can be raised, and the full rubric is at apis.io/rating/. Every facet and dimension name above is a link: it opens that measurement's own page — what it means, the exact checks that feed it, how the whole catalog distributes on it, and the providers at the top of it. This rating is computed from github.com/api-evangelist/splunk: open an issue to ask a question, or submit a pull request to add artifacts. Submit an artifact on GitHub — free → Manage your own listing — the Influence plan, $499/mo →

Markets this provider is in provisional

The Kin Score Market layer reads a provider inside its market: its position, and how deep its integrations go. Depth is only comparable within a position. Provisional and unweighted: not part of the Kin Score or agent readiness.

Market	Position	Depth	Registered MCP server	Declares compatibility
Observability	gravity	55.0	-	-
Security (EDR, SIEM, SOAR)	gravity	55.0	-	-

Registered MCP server and declares compatibility are report only — not weighted. Undeclared means we found nothing we can read, so there is no number: we never infer integrations.

APIs 14

Individual APIs this provider publishes, each with its own machine-readable definition.

Splunk

API monitoring checks to see if API-connected resources are available, working properly and responding to calls.

Splunk Cloud Platform REST API

The Splunk Cloud Platform REST API provides a subset of the Splunk Enterprise REST API endpoints for managing and interacting with your Splunk Cloud Platform deployment. Access ...

Splunk Cloud Admin Config Service (ACS) API

The Admin Config Service (ACS) is a cloud-native API that provides programmatic self-service administration capabilities for Splunk Cloud Platform. Administrators can use the AC...

Splunk Observability Cloud API

The Splunk Observability Cloud API provides REST endpoints for sending and managing metrics, traces, and events. It supports infrastructure monitoring, application performance m...

Splunk SOAR REST API

The Splunk SOAR REST API enables programmatic creation, updating, and management of security automation objects including containers, assets, playbooks, indicators, lists, and a...

Splunk Enterprise Security API

The Splunk Enterprise Security API provides REST endpoints for accessing and modifying findings, investigations, risk scores, assets, and identities in Splunk Enterprise Securit...

Splunk IT Service Intelligence (ITSI) REST API

The Splunk IT Service Intelligence (ITSI) REST API allows bulk creation and updating of ITOA interface objects such as entities, services, and KPI base searches. ITSI is a monit...

Splunk HTTP Event Collector (HEC) API

The Splunk HTTP Event Collector (HEC) is a high-performance REST API data input that accepts JSON or raw text data sent over HTTP or HTTPS. It uses token-based authentication an...

Splunk Intelligence Management API

The Splunk Intelligence Management (formerly ThreatStream) API provides REST v2.0 endpoints for managing threat intelligence data including indicators, observables, and intellig...

Splunk SOAR Playbook Automation API

The Splunk SOAR Playbook Automation API provides Python APIs for developing playbooks and automation within Splunk SOAR. It includes container, playbook, data access, vault, net...

Splunk AppInspect API

The Splunk AppInspect API validates Splunk apps and add-ons against Splunk best practices and requirements for publishing to Splunkbase or installing on Splunk Cloud Platform. I...

Splunk Data Inputs API

Endpoints for configuring and managing data inputs including monitors, TCP/UDP inputs, scripted inputs, and HTTP Event Collector (HEC) tokens. Data inputs define how Splunk inge...

Splunk Index API

Endpoints for managing Splunk indexes, which store and organize ingested data. Indexes can be created, modified, listed, and configured for retention and storage policies.

Splunk Search API

Endpoints for creating, managing, and retrieving search jobs and their results. Splunk search processing language (SPL) queries are submitted as search jobs that run asynchronou...

Scroll for all 14

Postman Collections 1

Ready-to-run Postman collections for exercising this provider's APIs.

Splunk Enterprise REST API

POSTMAN

Open Collections 5

Open, tool-agnostic API collections (OpenAPI-derived and Bruno).

API Collection

OPEN COLLECTION

Splunk Enterprise REST Data Inputs API

OPEN COLLECTION

Splunk Enterprise REST API

OPEN COLLECTION

Splunk Enterprise REST Data Inputs Index API

OPEN COLLECTION

Splunk Enterprise REST Data Inputs Search API

OPEN COLLECTION

Arazzo Workflows 6

Multi-step API workflows described with the Arazzo specification.

Splunk Finalize, Read, and Clean Up a Search Job

Dispatch a long search, finalize it early, read partial results, then delete the job.

ARAZZO

Splunk HEC Ingest an Event and Confirm Indexing

Provision a HEC token with acknowledgment, send a JSON event, and confirm it was indexed.

ARAZZO

Splunk Provision an Index and Attach a Monitor Input

Create an event index, verify it, then create a file monitor input that feeds it.

ARAZZO

Splunk Ingest Raw Data then Search for It

Send raw text to HEC, then run an SPL search and poll it to confirm the data landed.

ARAZZO

Splunk Run a Search Job and Retrieve Results

Dispatch an SPL search, poll the job until it finishes, then read the results.

ARAZZO

Splunk Search and Retrieve Raw Events

Run an SPL search, wait for it to finish, then pull the untransformed events.

ARAZZO

MCP Servers 1

Model Context Protocol servers that expose these APIs to AI agents.

MCP Server

MCP SERVER

Pricing Plans 1

Published pricing tiers and plan structures.

Splunk Plans Pricing

3 plans

PLANS

Rate Limits 1

Documented rate limits and quota policies.

Splunk Rate Limits

2 limits

RATE LIMITS

FinOps 1

Cost, billing, and metering signals for API financial operations.

Splunk Finops

FINOPS

Features 8

Notable capabilities this provider offers.

Splunk (now Cisco): hundreds of services across Observability + SIEM

Detailed pricing: see https://www.splunk.com/en_us/products/pricing.html

Service: Splunk Enterprise / Cloud (data ingest)

Service: Splunk Observability Cloud (APM, Logs, RUM, Synthetics)

Service: Splunk SOAR

Service: Splunk Enterprise Security (SIEM)

Service: Splunk ITSI

Service: Splunk SOC Platform

Scroll for all 8

Semantic Vocabularies 2

JSON-LD contexts and semantic vocabularies used across these APIs.

Splunk Context

0 classes · 15 properties

JSON-LD

Splunk Enterprise Rest Context

0 classes · 0 properties

JSON-LD

Spectral Rules 3

Spectral governance rulesets for linting and validating these APIs.

Splunk — jsonschema rules

5 rules · 3 warnings 2 info

SPECTRAL

Splunk API Rules

18 rules · 15 errors 1 warnings 2 info

SPECTRAL

Splunk API Rules

16 rules · 8 errors 7 warnings 1 info

SPECTRAL

JSON Schema 48

Standalone JSON Schema definitions for this provider's data models.

ErrorResponse

1 properties

JSON SCHEMA

HecEvent

7 properties

JSON SCHEMA

HecResponse

4 properties

JSON SCHEMA

HecTokenCreateRequest

8 properties

JSON SCHEMA

HecTokenList

3 properties

JSON SCHEMA

HecToken

2 properties

JSON SCHEMA

IndexCreateRequest

10 properties

JSON SCHEMA

IndexList

3 properties

JSON SCHEMA

Index

2 properties

JSON SCHEMA

IndexUpdateRequest

7 properties

JSON SCHEMA

MonitorInputCreateRequest

10 properties

JSON SCHEMA

MonitorInputList

3 properties

JSON SCHEMA

MonitorInput

2 properties

JSON SCHEMA

MonitorInputUpdateRequest

5 properties

JSON SCHEMA

Paging

3 properties

JSON SCHEMA

SearchJobCreateRequest

19 properties

JSON SCHEMA

SearchJobList

4 properties

JSON SCHEMA

SearchJob

2 properties

JSON SCHEMA

SearchResults

6 properties

JSON SCHEMA

TcpInputList

3 properties

JSON SCHEMA

TcpInput

2 properties

JSON SCHEMA

UdpInputList

3 properties

JSON SCHEMA

UdpInput

2 properties

JSON SCHEMA

ErrorResponse

1 properties

JSON SCHEMA

Splunk Event

19 properties

JSON SCHEMA

HecEvent

7 properties

JSON SCHEMA

HecResponse

4 properties

JSON SCHEMA

HecToken

2 properties

JSON SCHEMA

HecTokenCreateRequest

8 properties

JSON SCHEMA

HecTokenList

4 properties

JSON SCHEMA

Index

2 properties

JSON SCHEMA

IndexCreateRequest

10 properties

JSON SCHEMA

IndexList

4 properties

JSON SCHEMA

IndexUpdateRequest

7 properties

JSON SCHEMA

MonitorInput

2 properties

JSON SCHEMA

MonitorInputCreateRequest

10 properties

JSON SCHEMA

MonitorInputList

4 properties

JSON SCHEMA

MonitorInputUpdateRequest

5 properties

JSON SCHEMA

Paging

3 properties

JSON SCHEMA

Splunk Search Job

9 properties

JSON SCHEMA

SearchJob

2 properties

JSON SCHEMA

SearchJobCreateRequest

19 properties

JSON SCHEMA

SearchJobList

5 properties

JSON SCHEMA

SearchResults

6 properties

JSON SCHEMA

TcpInput

2 properties

JSON SCHEMA

TcpInputList

4 properties

JSON SCHEMA

UdpInput

2 properties

JSON SCHEMA

UdpInputList

4 properties

JSON SCHEMA

Scroll for all 48

JSON Structure 24

JSON Structure definitions describing this provider's data shapes.

Splunk Enterprise Rest Error Response Structure

1 properties

JSON STRUCTURE

Splunk Enterprise Rest Hec Event Structure

7 properties

JSON STRUCTURE

Splunk Enterprise Rest Hec Response Structure

4 properties

JSON STRUCTURE

Splunk Enterprise Rest Hec Token Create Request Structure

8 properties

JSON STRUCTURE

Splunk Enterprise Rest Hec Token List Structure

3 properties

JSON STRUCTURE

Splunk Enterprise Rest Hec Token Structure

2 properties

JSON STRUCTURE

Splunk Enterprise Rest Index Create Request Structure

10 properties

JSON STRUCTURE

Splunk Enterprise Rest Index List Structure

3 properties

JSON STRUCTURE

Splunk Enterprise Rest Index Structure

2 properties

JSON STRUCTURE

Splunk Enterprise Rest Index Update Request Structure

7 properties

JSON STRUCTURE

Splunk Enterprise Rest Monitor Input Create Request Structure

10 properties

JSON STRUCTURE

Splunk Enterprise Rest Monitor Input List Structure

3 properties

JSON STRUCTURE

Splunk Enterprise Rest Monitor Input Structure

2 properties

JSON STRUCTURE

Splunk Enterprise Rest Monitor Input Update Request Structure

5 properties

JSON STRUCTURE

Splunk Enterprise Rest Paging Structure

3 properties

JSON STRUCTURE

Splunk Enterprise Rest Search Job Create Request Structure

19 properties

JSON STRUCTURE

Splunk Enterprise Rest Search Job List Structure

4 properties

JSON STRUCTURE

Splunk Enterprise Rest Search Job Structure

2 properties

JSON STRUCTURE

Splunk Enterprise Rest Search Results Structure

6 properties

JSON STRUCTURE

Splunk Enterprise Rest Tcp Input List Structure

3 properties

JSON STRUCTURE

Splunk Enterprise Rest Tcp Input Structure

2 properties

JSON STRUCTURE

Splunk Enterprise Rest Udp Input List Structure

3 properties

JSON STRUCTURE

Splunk Enterprise Rest Udp Input Structure

2 properties

JSON STRUCTURE

Splunk Structure

0 properties

JSON STRUCTURE

Scroll for all 24

Examples 46

Example request and response payloads for these APIs.

Splunk Checkackstatus Example

6 fields

EXAMPLE

Splunk Controlsearchjob Example

6 fields

EXAMPLE

Splunk Createhttpinputtoken Example

6 fields

EXAMPLE

Splunk Createindex Example

6 fields

EXAMPLE

Splunk Createmonitorinput Example

6 fields

EXAMPLE

Splunk Createsearchjob Example

6 fields

EXAMPLE

Splunk Enterprise Rest Error Response Example

1 fields

EXAMPLE

Splunk Enterprise Rest Hec Event Example

7 fields

EXAMPLE

Splunk Enterprise Rest Hec Response Example

4 fields

EXAMPLE

Splunk Enterprise Rest Hec Token Create Request Example

8 fields

EXAMPLE

Splunk Enterprise Rest Hec Token Example

2 fields

EXAMPLE

Splunk Enterprise Rest Hec Token List Example

3 fields

EXAMPLE

Splunk Enterprise Rest Index Create Request Example

10 fields

EXAMPLE

Splunk Enterprise Rest Index Example

2 fields

EXAMPLE

Splunk Enterprise Rest Index List Example

3 fields

EXAMPLE

Splunk Enterprise Rest Index Update Request Example

7 fields

EXAMPLE

Splunk Enterprise Rest Monitor Input Create Request Example

10 fields

EXAMPLE

Splunk Enterprise Rest Monitor Input Example

2 fields

EXAMPLE

Splunk Enterprise Rest Monitor Input List Example

3 fields

EXAMPLE

Splunk Enterprise Rest Monitor Input Update Request Example

5 fields

EXAMPLE

Splunk Enterprise Rest Paging Example

3 fields

EXAMPLE

Splunk Enterprise Rest Search Job Create Request Example

19 fields

EXAMPLE

Splunk Enterprise Rest Search Job Example

2 fields

EXAMPLE

Splunk Enterprise Rest Search Job List Example

4 fields

EXAMPLE

Splunk Enterprise Rest Search Results Example

6 fields

EXAMPLE

Splunk Enterprise Rest Tcp Input Example

2 fields

EXAMPLE

Splunk Enterprise Rest Tcp Input List Example

3 fields

EXAMPLE

Splunk Enterprise Rest Udp Input Example

2 fields

EXAMPLE

Splunk Enterprise Rest Udp Input List Example

3 fields

EXAMPLE

Splunk Exportsearchresults Example

6 fields

EXAMPLE

Splunk Getindex Example

6 fields

EXAMPLE

Splunk Getmonitorinput Example

6 fields

EXAMPLE

Splunk Getsearchevents Example

6 fields

EXAMPLE

Splunk Getsearchjob Example

6 fields

EXAMPLE

Splunk Getsearchresults Example

6 fields

EXAMPLE

Splunk Listhttpinputtokens Example

6 fields

EXAMPLE

Splunk Listindexes Example

6 fields

EXAMPLE

Splunk Listmonitorinputs Example

6 fields

EXAMPLE

Splunk Listsearchjobs Example

6 fields

EXAMPLE

Splunk Listtcpcookedinputs Example

6 fields

EXAMPLE

Splunk Listtcprawinputs Example

6 fields

EXAMPLE

Splunk Listudpinputs Example

6 fields

EXAMPLE

Splunk Sendevent Example

6 fields

EXAMPLE

Splunk Sendrawevent Example

6 fields

EXAMPLE

Splunk Updateindex Example

6 fields

EXAMPLE

Splunk Updatemonitorinput Example

6 fields

EXAMPLE

Scroll for all 46

Security Posture 4

Authentication, domain security, vulnerability disclosure, and trust-center signals.

Splunk Authentication

apiKey/http · 3 schemes

SECURITY

Splunk Domain Security

TLSv1.3 · HSTS · DMARC

SECURITY

Splunk Vulnerability Disclosure

security.txt · contact published

SECURITY

Splunk Trust Center

SOC 2, ISO 27001, ISO 27017, ISO 27018, PCI DSS, HIPAA, FedRAMP, GDPR, CSA STAR

SECURITY

Agentic Access 1

Recommended x-agentic-access execution contracts for AI agents.

Splunk Agentic Access

26 operations · 13 acting · 1 human-in-the-loop

26 operations · 13 acting

AGENTIC

Use Cases 6

What developers build with this provider.

Security Information and Event Management

Centralize security event data for real-time threat detection, investigation, and compliance reporting.

IT Operations Monitoring

Monitor infrastructure health, application performance, and service availability across hybrid environments.

Log Management

Collect, index, and analyze log data from servers, applications, and network devices for troubleshooting.

Incident Response Automation

Automate security incident triage, enrichment, and response using SOAR playbooks and integrations.

Application Performance Monitoring

Trace application requests end-to-end to identify bottlenecks and optimize performance.

Compliance and Audit

Generate compliance reports and audit trails from indexed data to meet regulatory requirements.

Integrations 8

Pre-built integrations with other platforms and tools.

AWS

Ingest and analyze AWS CloudTrail, CloudWatch, VPC Flow Logs, and other AWS service data.

Azure

Collect and analyze Azure activity logs, metrics, and diagnostic data.

Google Cloud

Ingest Google Cloud audit logs, metrics, and Pub/Sub messages for cloud monitoring.

Kubernetes

Monitor Kubernetes clusters with metrics, logs, and events from containers and orchestration.

ServiceNow

Integrate Splunk alerts and incidents with ServiceNow ITSM for ticketing and workflow automation.

PagerDuty

Trigger PagerDuty incidents from Splunk alerts for on-call notification and escalation.

Cisco

Collect and analyze Cisco network device logs, firewall events, and security telemetry.

CrowdStrike

Ingest CrowdStrike Falcon endpoint detection data for correlated threat analysis.

Scroll for all 8

Resources

Get Started 5

Portal, sign-up, and the first successful call

SignUp

DeveloperPortal

GettingStarted

Signup

Developer License

Signup

Documentation 8

Reference material describing how the API behaves

APIReference

APIReference

ContributionGuide

Community

Documentation

Help Center

Developer Tools

Downloads

Custom REST Endpoints

Documentation

Scroll for all 8

Agent Surfaces 5

MCP servers, agent skills, and machine-readable catalogs

AgentSkill

LLMsTxt

WellKnown

AgenticAccess

MCPServer

Design & Contract 15

Pagination, idempotency, versioning, errors, and events

Spectral

Spectral

Spectral

JSONLD

Vocabulary

DataModel

ErrorCatalog

Conformance

Arazzo

Arazzo

Arazzo

Arazzo

Arazzo

Arazzo

SpectralRules

Scroll for all 15

Build 9

SDKs, sample code, and the tooling you integrate with

CodeOfConduct

CodeOfConduct

PostmanWorkspace

PostmanWorkspace

GitHubOrganization

Python SDK

Java SDK

JavaScript SDK

C# SDK

C# SDK Documentation

SDKs

OpenTelemetry Collector

GitHubRepository

Scroll for all 9

Access & Security 11

Authentication, authorization, and security posture

Compliance

SecurityTxt

SecurityTxt

SecurityTxt

TrustCenter

VulnerabilityDisclosure

VulnerabilityDisclosure

DomainSecurity

Authentication

Authentication

Auth Tokens

Security

Scroll for all 11

Operate 8

Status, limits, changes, and where to get help

RateLimits

IssueTracker

Releases

Support

ChangeLog

What's New

Release Notes

StatusPage

Scroll for all 8

Commercial 7

Pricing, plans, and the legal terms of use

FinOps

Plans

License

Pricing

TermsOfService

General Terms

PrivacyPolicy

Scroll for all 7

Company 4

The organization behind the API

Newsroom

Newsroom

Website

Website

Blog

Blog

LinkedIn

Other 11

Properties that don't map to a standard resource type

AgentCard

Hosts

Vendors

ParentCompany

Marketplace

Subsidiary

Subsidiary

Subsidiary

Subsidiary

CapabilityMap

Scroll for all 11

Source (apis.yml)

aid: splunk
name: Splunk
description: Splunk is a data platform that enables organizations to search, monitor, analyze, and visualize massive streams
  of machine-generated data across security, observability, and AI use cases. It offers solutions for security information
  and event management (SIEM), infrastructure monitoring, application performance monitoring, and AI-driven analytics, helping
  enterprises turn data into actionable insights and operational intelligence.
deliveryModel:
  model: open-core
  license: Apache-2.0
  open_source: true
  commercial: true
  callable_host: false
  label: Open core · an OSS project plus a commercial hosted product
  confidence: high
  source:
  - license
  - openapi
  - pricing
  generated: '2026-08-28'
  method: derived
accessModel:
  pricing: free
  onboarding: self-serve
  trial: false
  try_now: true
  public: false
  label: Free · Self-serve signup
  confidence: medium
  source:
  - plans
  - authentication
  - security
  generated: '2026-09-03'
  method: derived
image: https://www.splunk.com/content/dam/splunk2/images/icons/favicons/favicon.ico
url: https://raw.githubusercontent.com/api-evangelist/splunk/refs/heads/main/apis.yml
created: '2025-01-08'
modified: '2026-08-19'
specificationVersion: '0.23'
type: Index
access: 3rd-Party
position: Consuming
tags:
- Analytics
- Data Analysis
- Logging
- Machine Data
- Monitoring
- Observability
- Platform
- Security
- SIEM
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com
- name: Splunk Inc.
  email: devinfo@splunk.com
  url: https://www.splunk.com
common:
- type: FinOps
  url: finops/splunk-finops.yml
- type: RateLimits
  url: rate-limits/splunk-rate-limits.yml
- type: Plans
  url: plans/splunk-plans-pricing.yml
- type: Spectral
  url: rules/splunk-spectral-rules.yml
- type: Spectral
  url: rules/splunk-rules.yml
- type: Spectral
  url: rules/splunk-jsonschema-spectral-rules.yml
- type: JSONLD
  url: json-ld/splunk-enterprise-rest-context.jsonld
- type: Vocabulary
  url: vocabulary/splunk-vocabulary.yml
- type: AgentSkill
  url: skills/_index.yml
- type: DataModel
  url: data-model/splunk-data-model.yml
- type: Compliance
  url: https://customertrust.splunk.com/
- type: ErrorCatalog
  url: errors/splunk-problem-types.yml
- type: Conformance
  url: conformance/splunk-conformance.yml
- type: LLMsTxt
  url: llms/splunk-llms.txt
- type: AgentCard
  url: a2a/splunk-a2a.yml
- type: SecurityTxt
  url: well-known/splunk-security.txt
- type: SecurityTxt
  url: well-known/splunk-apis-security.txt
- type: SecurityTxt
  url: well-known/splunk-advisory-security.txt
- type: WellKnown
  url: well-known/splunk-well-known.yml
- type: Hosts
  url: hosts/splunk-hosts.yml
- type: Vendors
  url: vendors/splunk-vendors.yml
- type: SignUp
  url: http://idp.login.splunk.com/signin/register?redirecturl=https://docs.splunk.com/Documentation?action=pdfbook&product=SARIAddOn&title=Documentation%253ASARIAddOn%253AInstall%253AGetStarted%253A1.0.0&topic=1&version=1.1.2
- type: Newsroom
  url: https://www.splunk.com/en_us/newsroom/media-kit.html
- type: APIReference
  url: https://agent-observability-docs.splunk.com/llms.txt
- type: Website
  url: https://www.splunk.com/
- type: IssueTracker
  url: https://github.com/signalfx/splunk-otel-collector/issues
- type: Releases
  url: https://github.com/signalfx/splunk-otel-collector/releases
- type: CodeOfConduct
  url: https://github.com/signalfx/splunk-otel-collector/blob/main/CODE_OF_CONDUCT.md
- type: ContributionGuide
  url: https://github.com/signalfx/splunk-otel-collector/blob/main/CONTRIBUTING.md
- type: ParentCompany
  url: https://apis.io/providers/cisco/
  name: Cisco
  x-relationship: acquisition
  x-generated-by: cisco-family:2026-08-19
  x-acquired: 2024
- type: License
  name: Apache-2.0
  url: https://github.com/signalfx/splunk-otel-collector/blob/main/LICENSE
- type: AgenticAccess
  url: agentic-access/splunk-agentic-access.yml
- type: TrustCenter
  url: security/splunk-trust-center.yml
- type: VulnerabilityDisclosure
  url: security/splunk-vulnerability-disclosure.yml
- type: DomainSecurity
  url: security/splunk-domain-security.yml
- type: Authentication
  url: authentication/splunk-authentication.yml
- type: PostmanWorkspace
  url: https://www.postman.com/kinlaneapi/splunk/overview
- type: Arazzo
  url: arazzo/splunk-control-and-cleanup-search-workflow.yml
  name: Splunk Finalize, Read, and Clean Up a Search Job
- type: Arazzo
  url: arazzo/splunk-hec-ingest-and-acknowledge-workflow.yml
  name: Splunk HEC Ingest an Event and Confirm Indexing
- type: Arazzo
  url: arazzo/splunk-provision-index-and-monitor-workflow.yml
  name: Splunk Provision an Index and Attach a Monitor Input
- type: Arazzo
  url: arazzo/splunk-raw-ingest-and-search-workflow.yml
  name: Splunk Ingest Raw Data then Search for It
- type: Arazzo
  url: arazzo/splunk-run-search-job-workflow.yml
  name: Splunk Run a Search Job and Retrieve Results
- type: Arazzo
  url: arazzo/splunk-search-events-workflow.yml
  name: Splunk Search and Retrieve Raw Events
- type: DeveloperPortal
  url: https://dev.splunk.com/
- type: Blog
  url: https://www.splunk.com/en_us/blog
- type: Support
  url: https://www.splunk.com/en_us/support-and-services.html
- type: Documentation
  url: https://community.splunk.com/
  title: Community
- type: GitHubOrganization
  url: https://github.com/splunk
- type: Documentation
  url: https://docs.splunk.com/Documentation
- type: Documentation
  url: https://help.splunk.com/en
  title: Help Center
- type: GettingStarted
  url: https://dev.splunk.com/enterprise/docs
- type: Documentation
  url: https://dev.splunk.com/enterprise/docs/devtools/
  title: Developer Tools
- type: Documentation
  url: https://dev.splunk.com/enterprise/downloads
  title: Downloads
- type: Marketplace
  url: https://splunkbase.splunk.com/
- type: Pricing
  url: https://www.splunk.com/en_us/products/pricing.html
- type: Signup
  url: https://www.splunk.com/en_us/download/splunk-cloud.html
- type: Signup
  url: https://dev.splunk.com/enterprise/dev_license/
  title: Developer License
- type: TermsOfService
  url: https://www.splunk.com/en_us/legal/terms/terms-of-use.html
- type: TermsOfService
  url: https://www.splunk.com/en_us/legal/splunk-general-terms.html
  title: General Terms
- type: ChangeLog
  url: https://help.splunk.com/en/splunk-enterprise/release-notes-and-updates
- type: Authentication
  url: https://docs.splunk.com/Documentation/Splunk/latest/RESTUM/RESTusing
- type: SDKs
  url: https://github.com/splunk/splunk-sdk-python
  title: Python SDK
- type: SDKs
  url: https://github.com/splunk/splunk-sdk-java
  title: Java SDK
- type: SDKs
  url: https://github.com/splunk/splunk-sdk-javascript
  title: JavaScript SDK
- type: SDKs
  url: https://github.com/splunk/splunk-sdk-csharp-pcl
  title: C# SDK
- type: SDKs
  url: https://dev.splunk.com/enterprise/docs/devtools/csharp
  title: C# SDK Documentation
- type: ChangeLog
  url: https://dev.splunk.com/enterprise/docs/whatsnew/
  title: What's New
- type: ChangeLog
  url: https://dev.splunk.com/enterprise/docs/relnotes
  title: Release Notes
- type: Documentation
  url: https://dev.splunk.com/enterprise/docs/devtools/customrestendpoints
  title: Custom REST Endpoints
- type: Authentication
  url: https://docs.splunk.com/Documentation/Splunk/latest/Security/UseAuthTokens
  title: Auth Tokens
- type: PrivacyPolicy
  url: https://www.splunk.com/en_us/legal/privacy-policy.html
- type: Security
  url: https://www.splunk.com/en_us/about-splunk/splunk-data-security-and-privacy.html
- type: GitHubRepository
  url: https://github.com/signalfx/splunk-otel-collector
  title: OpenTelemetry Collector
- type: LinkedIn
  url: https://www.linkedin.com/company/splunk
- type: X
  url: https://twitter.com/splunk
- type: SpectralRules
  url: rules/splunk-spectral-rules.yml
- type: Features
  url: https://www.splunk.com/en_us/products.html
  data:
  - 'Splunk (now Cisco): hundreds of services across Observability + SIEM'
  - 'Detailed pricing: see https://www.splunk.com/en_us/products/pricing.html'
  - 'Service: Splunk Enterprise / Cloud (data ingest)'
  - 'Service: Splunk Observability Cloud (APM, Logs, RUM, Synthetics)'
  - 'Service: Splunk SOAR'
  - 'Service: Splunk Enterprise Security (SIEM)'
  - 'Service: Splunk ITSI'
  - 'Service: Splunk SOC Platform'
  sources:
  - https://www.splunk.com/en_us/products/pricing.html
  - https://focus.finops.org/
  updated: '2026-05-04'
- type: UseCases
  url: https://www.splunk.com/en_us/solutions.html
  data:
  - name: Security Information and Event Management
    description: Centralize security event data for real-time threat detection, investigation, and compliance reporting.
  - name: IT Operations Monitoring
    description: Monitor infrastructure health, application performance, and service availability across hybrid environments.
  - name: Log Management
    description: Collect, index, and analyze log data from servers, applications, and network devices for troubleshooting.
  - name: Incident Response Automation
    description: Automate security incident triage, enrichment, and response using SOAR playbooks and integrations.
  - name: Application Performance Monitoring
    description: Trace application requests end-to-end to identify bottlenecks and optimize performance.
  - name: Compliance and Audit
    description: Generate compliance reports and audit trails from indexed data to meet regulatory requirements.
- type: Integrations
  url: https://splunkbase.splunk.com/
  data:
  - name: AWS
    description: Ingest and analyze AWS CloudTrail, CloudWatch, VPC Flow Logs, and other AWS service data.
  - name: Azure
    description: Collect and analyze Azure activity logs, metrics, and diagnostic data.
  - name: Google Cloud
    description: Ingest Google Cloud audit logs, metrics, and Pub/Sub messages for cloud monitoring.
  - name: Kubernetes
    description: Monitor Kubernetes clusters with metrics, logs, and events from containers and orchestration.
  - name: ServiceNow
    description: Integrate Splunk alerts and incidents with ServiceNow ITSM for ticketing and workflow automation.
  - name: PagerDuty
    description: Trigger PagerDuty incidents from Splunk alerts for on-call notification and escalation.
  - name: Cisco
    description: Collect and analyze Cisco network device logs, firewall events, and security telemetry.
  - name: CrowdStrike
    description: Ingest CrowdStrike Falcon endpoint detection data for correlated threat analysis.
- name: MCP Server
  url: https://github.com/splunk/splunk-mcp-server2
  type: MCPServer
- type: Subsidiary
  url: https://apis.io/providers/signalfx/
  name: SignalFx
  x-relationship: acquisition
  x-generated-by: cisco-family:2026-08-19
  x-acquired: 2019
- type: Subsidiary
  url: https://apis.io/providers/splunk-observability/
  name: Splunk Observability Cloud
  x-relationship: product
  x-generated-by: cisco-family:2026-08-19
- type: Subsidiary
  url: https://apis.io/providers/splunk-soar/
  name: Splunk SOAR
  x-relationship: acquisition
  x-generated-by: cisco-family:2026-08-19
  x-acquired: 2018
- type: Subsidiary
  url: https://apis.io/providers/victorops/
  name: Splunk On-Call (VictorOps)
  x-relationship: acquisition
  x-generated-by: cisco-family:2026-08-19
  x-acquired: 2018
- type: CapabilityMap
  url: capabilities/splunk-capability-edges.yml
  name: Splunk Business Capability Map
- type: StatusPage
  url: https://www.splunk.com/en_us/customer-success/splunk-services-status.html
apis:
- aid: splunk:splunk
  name: Splunk
  description: API monitoring checks to see if API-connected resources are available, working properly and responding to calls.
  humanURL: https://www.splunk.com/en_us/blog/learn/api-monitoring.html
  tags: []
  properties:
  - type: Documentation
    url: https://www.splunk.com/en_us/blog/learn/api-monitoring.html
- aid: splunk:splunk-cloud-platform-rest-api
  name: Splunk Cloud Platform REST API
  description: The Splunk Cloud Platform REST API provides a subset of the Splunk Enterprise REST API endpoints for managing
    and interacting with your Splunk Cloud Platform deployment. Access requires port 8089 to be opened by Splunk Support.
  humanURL: https://help.splunk.com/en/splunk-cloud-platform/rest-api-reference
  tags:
  - Cloud
  - Data
  - Management
  - REST
  - Search
  properties:
  - type: Documentation
    url: https://help.splunk.com/en/splunk-cloud-platform/rest-api-reference
  - type: GettingStarted
    url: https://docs.splunk.com/Documentation/SplunkCloud/latest/RESTTUT/RESTandCloud
  - type: APIReference
    url: https://docs.splunk.com/Documentation/SplunkCloud/latest/RESTREF/RESTprolog
- aid: splunk:splunk-cloud-admin-config-service-api
  name: Splunk Cloud Admin Config Service (ACS) API
  description: The Admin Config Service (ACS) is a cloud-native API that provides programmatic self-service administration
    capabilities for Splunk Cloud Platform. Administrators can use the ACS API to manage indexes, IP allow lists, HEC tokens,
    users, and roles without assistance from Splunk Support. ACS provides an OpenAPI 3.0 specification.
  humanURL: https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ACSIntro
  tags:
  - Administration
  - Cloud
  - Configuration
  - Management
  properties:
  - type: Documentation
    url: https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ACSIntro
  - type: GettingStarted
    url: https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ACSusage
  - type: APIReference
    url: https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ACSREF
- aid: splunk:splunk-observability-cloud-api
  name: Splunk Observability Cloud API
  description: The Splunk Observability Cloud API provides REST endpoints for sending and managing metrics, traces, and events.
    It supports infrastructure monitoring, application performance monitoring (APM), real user monitoring, and synthetic monitoring
    use cases.
  humanURL: https://dev.splunk.com/observability/
  tags:
  - APM
  - Metrics
  - Monitoring
  - Observability
  - Traces
  properties:
  - type: Documentation
    url: https://dev.splunk.com/observability/docs
  - type: APIReference
    url: https://dev.splunk.com/observability/reference
  - type: APIReference
    url: https://dev.splunk.com/observability/docs/apibasics/api_list/
    title: API List
  - type: Authentication
    url: https://dev.splunk.com/observability/docs/apibasics/authentication_basics/
  - type: Documentation
    url: https://dev.splunk.com/observability/docs/datamodel/ingest/
    title: Data Ingest
  - type: APIReference
    url: https://dev.splunk.com/observability/reference/api/ingest_data/latest
    title: Ingest Data Reference
  - type: Documentation
    url: https://dev.splunk.com/observability/docs/administration/authtokens
    title: Auth Tokens
- aid: splunk:splunk-soar-rest-api
  name: Splunk SOAR REST API
  description: The Splunk SOAR REST API enables programmatic creation, updating, and management of security automation objects
    including containers, assets, playbooks, indicators, lists, and audit records. REST API requests must be performed over
    HTTPS with token-based or basic authentication.
  humanURL: https://docs.splunk.com/Documentation/SOAR/current/PlatformAPI/Using
  tags:
  - Automation
  - Orchestration
  - Playbooks
  - Security
  - SOAR
  properties:
  - type: Documentation
    url: https://docs.splunk.com/Documentation/SOAR/current/PlatformAPI/Using
  - type: Documentation
    url: https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-cloud
    title: SOAR Cloud REST API Reference
  - type: APIReference
    url: https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/container-endpoints/rest-containers
    title: Container Endpoints
  - type: APIReference
    url: https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/artifact-endpoints/rest-artifact
    title: Artifact Endpoints
  - type: Documentation
    url: https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises
    title: SOAR On-Premises REST API Reference
- aid: splunk:splunk-enterprise-security-api
  name: Splunk Enterprise Security API
  description: The Splunk Enterprise Security API provides REST endpoints for accessing and modifying findings, investigations,
    risk scores, assets, and identities in Splunk Enterprise Security. It includes an OpenAPI specification for download.
  humanURL: https://help.splunk.com/en/splunk-enterprise-security-8/api-reference
  tags:
  - Enterprise Security
  - Findings
  - Investigations
  - Security
  - SIEM
  properties:
  - type: Documentation
    url: https://help.splunk.com/en/splunk-enterprise-security-8/api-reference
  - type: APIReference
    url: https://help.splunk.com/en/splunk-enterprise-security-8/rest-api-reference
  - type: GettingStarted
    url: https://dev.splunk.com/enterprise/docs/devtools/enterprisesecurity
  - type: APIReference
    url: https://help.splunk.com/en/splunk-enterprise-security-8/rest-api-reference/8.0/threat-intelligence-endpoints/threat-intelligence-api-reference
    title: Threat Intelligence API
  - type: Documentation
    url: https://dev.splunk.com/enterprise/docs/devtools/enterprisesecurity/threatintelligenceframework/
    title: Threat Intelligence Framework
- aid: splunk:splunk-itsi-rest-api
  name: Splunk IT Service Intelligence (ITSI) REST API
  description: The Splunk IT Service Intelligence (ITSI) REST API allows bulk creation and updating of ITOA interface objects
    such as entities, services, and KPI base searches. ITSI is a monitoring and analytics solution powered by artificial intelligence
    for IT Operations (AIOps).
  humanURL: https://help.splunk.com/en/splunk-it-service-intelligence/splunk-it-service-intelligence/leverage-rest-apis/4.19/itsi-rest-api-schema/itsi-rest-api-schema
  tags:
  - AIOps
  - IT Service Intelligence
  - ITSI
  - Monitoring
  properties:
  - type: Documentation
    url: https://help.splunk.com/en/splunk-it-service-intelligence/splunk-it-service-intelligence/leverage-rest-apis/4.19/itsi-rest-api-schema/itsi-rest-api-schema
  - type: APIReference
    url: https://help.splunk.com/en/splunk-it-service-intelligence/splunk-it-service-intelligence/leverage-rest-apis/4.18/itsi-rest-api-reference/itsi-rest-api-reference
- aid: splunk:splunk-http-event-collector-api
  name: Splunk HTTP Event Collector (HEC) API
  description: The Splunk HTTP Event Collector (HEC) is a high-performance REST API data input that accepts JSON or raw text
    data sent over HTTP or HTTPS. It uses token-based authentication and provides endpoints for sending events (/services/collector/event),
    raw data (/services/collector/raw), and checking indexing status (/services/collector/ack).
  humanURL: https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector
  tags:
  - Data Ingestion
  - Event
  - HEC
  - Logging
  - REST
  tags_raw:
  - Data Ingestion
  - Events
  - HEC
  - Logging
  - REST
  properties:
  - type: Documentation
    url: https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector
  - type: APIReference
    url: https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/HECRESTendpoints
  - type: Documentation
    url: https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/FormateventsforHTTPEventCollector
    title: Event Format
  - type: Documentation
    url: https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/HECExamples
    title: HEC Examples
  - type: GettingStarted
    url: https://dev.splunk.com/view/event-collector/SP-CAAAE6M
- aid: splunk:splunk-intelligence-management-api
  name: Splunk Intelligence Management API
  description: The Splunk Intelligence Management (formerly ThreatStream) API provides REST v2.0 endpoints for managing threat
    intelligence data including indicators, observables, and intelligence sources. It supports STIX and TAXII formats for
    sharing cyber threat intelligence over HTTPS.
  humanURL: https://docs.splunk.com/Documentation/SIM/current/Develop/RESTv20
  tags:
  - Indicators
  - Security
  - STIX
  - TAXII
  - Threat Intelligence
  properties:
  - type: Documentation
    url: https://docs.splunk.com/Documentation/SIM/current/Develop/RESTv20
  - type: Documentation
    url: https://docs.splunk.com/Documentation/SIM/current/User/Threatintelsources
    title: Threat Intel Sources
  - type: Documentation
    url: https://docs.splunk.com/Documentation/SIM/current/Intro/UsagePolicy
    title: Usage Policy
- aid: splunk:splunk-soar-playbook-automation-api
  name: Splunk SOAR Playbook Automation API
  description: The Splunk SOAR Playbook Automation API provides Python APIs for developing playbooks and automation within
    Splunk SOAR. It includes container, playbook, data access, vault, network, and session automation APIs for building detailed
    security orchestration workflows.
  humanURL: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/python-playbook-api-reference/overview/about-splunk-soar-cloud-playbook-automation-apis
  tags:
  - Automation
  - Orchestration
  - Playbooks
  - Security
  - SOAR
  properties:
  - type: Documentation
    url: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/python-playbook-api-reference/overview/about-splunk-soar-cloud-playbook-automation-apis
  - type: APIReference
    url: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/python-playbook-api-reference/automation-api/container-automation-api
    title: Container Automation
  - type: APIReference
    url: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/python-playbook-api-reference/automation-api/playbook-automation-api
    title: Playbook Automation
  - type: APIReference
    url: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/python-playbook-api-reference/automation-api/data-access-automation-api
    title: Data Access Automation
  - type: APIReference
    url: https://help.splunk.com/en/splunk-soar/soar-cloud/develop-apps/python-playbook-api-reference/automation-api/vault-automation-api
    title: Vault Automation
- aid: splunk:splunk-appinspect-api
  name: Splunk AppInspect API
  description: The Splunk AppInspect API validates Splunk apps and add-ons against Splunk best practices and requirements
    for publishing to Splunkbase or installing on Splunk Cloud Platform. It provides automated app vetting through a REST
    API.
  humanURL: https://dev.splunk.com/enterprise/docs/relnotes/relnotes-appinspectapi/whatsnew
  tags:
  - Application
  - Cloud
  - Splunkbase
  - Validation
  tags_raw:
  - Apps
  - Cloud
  - Splunkbase
  - Validation
  properties:
  - type: ChangeLog
    url: https://dev.splunk.com/enterprise/docs/relnotes/relnotes-appinspectapi/whatsnew
  - type: APIReference
    url: https://dev.splunk.com/enterprise/reference
- aid: splunk:splunk-data-inputs-api
  name: Splunk Data Inputs API
  description: Endpoints for configuring and managing data inputs including monitors, TCP/UDP inputs, scripted inputs, and
    HTTP Event Collector (HEC) tokens. Data inputs define how Splunk ingests data.
  humanURL: https://www.splunk.com/en_us/blog/learn/api-monitoring.html
  tags:
  - Data Inputs
  properties:
  - type: OpenAPI
    url: openapi/splunk-data-inputs-api-openapi.yml
  - type: Documentation
    url: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTprolog
  - type: GettingStarted
    url: https://docs.splunk.com/Documentation/Splunk/latest/RESTUM/RESTusing
  - type: APIReference
    url: https://dev.splunk.com/enterprise/reference
  - type: APIReference
    url: https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.2/introduction/endpoints-reference-list
  - type: Authentication
    url: https://docs.splunk.com/Documentation/Splunk/latest/RESTUM/RESTusing
  - type: Documentation
    url: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch
  - type: JSONSchema
    url: json-schema/splunk-search-job-schema.json
  - type: JSONSchema
    url: json-schema/splunk-event-schema.json
  - type: JSONLD
    url: json-ld/splunk-context.jsonld
- aid: splunk:splunk-index-api
  name: Splunk Index API
  description: Endpoints for managing Splunk indexes, which store and organize ingested data. Indexes can be created, modified,
    listed, and configured for retention and storage policies.
  humanURL: https://www.splunk.com/en_us/blog/learn/api-monitoring.html
  tags:
  - Index
  properties:
  - type: OpenAPI
    url: openapi/splunk-index-api-openapi.yml
  - type: Documentation
    url: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTprolog
  - type: GettingStarted
    url: https://docs.splunk.com/Documentation/Splunk/latest/RESTUM/RESTusing
  - type: APIReference
    url: https://dev.splunk.com/enterprise/reference
  - type: APIReference
    url: https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.2/introduction/endpoints-reference-list
  - type: Authentication
    url: https://docs.splunk.com/Documentation/Splunk/latest/RESTUM/RESTusing
  - type: Documentation
    url: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch
  - type: JSONSchema
    url: json-schema/splunk-search-job-schema.json
  - type: JSONSchema
    url: json-schema/splunk-event-schema.json
  - type: JSONLD
    url: json-ld/splunk-context.jsonld
- aid: splunk:splunk-search-api
  name: Splunk Search API
  description: Endpoints for creating, managing, and retrieving search jobs and their results. Splunk search processing language
    (SPL) queries are submitted as search jobs that run asynchronously.
  humanURL: https://www.splunk.com/en_us/blog/learn/api-monitoring.html
  tags:
  - Search
  properties:
  - type: OpenAPI
    url: openapi/splunk-search-api-openapi.yml
  - type: Documentation
    url: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTprolog
  - type: GettingStarted
    url: https://docs.splunk.com/Documentation/Splunk/latest/RESTUM/RESTusing
  - type: APIReference
    url: https://dev.splunk.com/enterprise/reference
  - type: APIReference
    url: https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.2/introduction/endpoints-reference-list
  - type: Authentication
    url: https://docs.splunk.com/Documentation/Splunk/latest/RESTUM/RESTusing
  - type: Documentation
    url: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch
  - type: JSONSchema
    url: json-schema/splunk-search-job-schema.json
  - type: JSONSchema
    url: json-schema/splunk-event-schema.json
  - type: JSONLD
    url: json-ld/splunk-context.jsonld
x-parent: cisco
x-relationship: acquisition
x-acquired: 2024
x-coverage:
  state: unreadable
  reason: no-machine-readable-spec
  detail: No OpenAPI or other machine-readable contract was found despite probing common spec URLs on api.splunk.com and docs
    hosts.
  evidence:
  - url: https://api.splunk.com/openapi.json
    status: 404
  checked: '2026-10-03'
x-enrichment:
  date: '2026-10-03'
  status: enriched
  artifacts_added: 26
  pass: modular-v1
  engine: identity=local,contract=local,surfaces=local,docs=local,regulatory=local

Work with this as data

Every provider here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for providers

9 MCP tools reach this

find_providersBrowse and filter every provider in the catalog.
get_provider_artifactsEvery artifact this provider publishes, grouped by type.
get_provider_operationsEvery operation across all of their OpenAPIs — one call instead of parsing every spec.
get_provider_toolsEvery MCP tool they ship, with the operation each wraps.
get_provider_evidenceHow each part of their score was established. Free — the basis for a claim should not sit behind it.
get_provider_ratingPRO — composite, band, trend and facet scores.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This provider

curl "https://apis.io/api/v1/providers/splunk"

All providers

curl "https://apis.io/api/v1/providers?limit=25"

Every operation they expose

curl "https://apis.io/api/v1/providers/splunk/operations?limit=25"

How their score was established

curl "https://apis.io/api/v1/providers/splunk/evidence"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.