Splunk
Splunk SIEM integration for running SPL search queries (blocking, normal, oneshot modes), retrieving search results with pagination, managing saved searches (list and dispatch), listing indexes, getting server info, and sending events via HTTP Event Collector (HEC). Supports two auth modes: Auth Token for REST API operations (search, indexes, server info, saved searches) and HEC Token for event ingestion. Nodes can work standalone with inline credentials or via a shared Connect/Disconnect session using a client ID.
| Namespace | Robomotion.Splunk |
| Version | 1.1.0 |
| Category | Analytics, IT Operations |
| Nodes | 10 |
Nodes
| Node | Description |
|---|---|
| Connect | Opens a connection to Splunk and returns a Client ID. |
| Disconnect | Closes a Splunk connection. |
| Run Search | Runs a search in Splunk. |
| Get Search Results | Gets search results in Splunk. |
| Send Event | Sends an event in Splunk. |
| List Indexes | Lists indexes in Splunk. |
| List Saved Searches | Lists saved searches in Splunk. |
| Run Saved Search | Runs a saved search in Splunk. |
| Get Server Info | Gets a server info in Splunk. |
| Toolkit | Exposes this package's operations to an AI Agent as a single tool. |
Connecting
This package has a Connect node. Run it once at the start of your flow; it returns a Client ID that the other nodes take as input. Pair it with Disconnect so the connection is released when the flow ends.
Credentials belong in a Vault rather than typed into the node.
AI Agent tools
9 of these nodes are exposed as tools an AI Agent can call directly:
Connect, Disconnect, Run Search, Get Search Results, Send Event, List Indexes, List Saved Searches, Run Saved Search, Get Server Info.
Generated from the package spec that the Flow Designer itself loads, so the node list and every property below match the version above exactly.
It does not yet include worked examples or service-specific guidance — those are written by hand, and a plausible-sounding guess in a reference page is worse than an honest gap. If you build something useful with this package, the community is the place to share it.