Splunk

Run SPL searches, manage saved searches, ingest events through HEC, and inspect indexes and server health from your flows over the Splunk REST API and HTTP Event Collector.

13 actions available

A scheduled flow runs an SPL search for errors over the last interval

Agent reads the result rows, such as counts by URI or host

Agent compares the counts against a threshold to decide if this is signal or noise

Agent records the metrics summary and attaches the offending events

Agent posts the summary and event sample to the on-call channel

The on-call engineer decides whether to open an incident before any page goes out

What This Integration Enables

FlowRunner agents use Splunk to close the gap between a search result and the rest of the stack. An agent can run an SPL search on a schedule with the async job flow or a oneshot call, route the results into alerts, tickets, or dashboards, and trigger a saved search or alert and act on what it returns. It can ingest application, workflow, and webhook events into Splunk through the HTTP Event Collector for centralized logging, and monitor index sizes, event counts, and server health as part of an operational flow. What it does not do is decide on its own that a result is worth paging a human. That call belongs to the on-call engineer, and the agent brings them the context to make it.

Without FlowRunner

Dashboard watching Someone keeps a Splunk tab open and eyeballs it for spikes

Late escalation An error trend is noticed hours after it started

Noisy paging Every threshold breach pages a person, real or not

With FlowRunner

Scheduled search The agent runs the SPL search on an interval and reads the rows

Early summary A metrics summary reaches the channel as soon as the trend appears

Human on the page Only a person turns a flagged result into an incident

Use Case Scenarios

Scheduled search into a triaged summary

A scheduled flow runs a oneshot SPL search for HTTP 500s grouped by URI. The agent reads the result rows and compares the counts against a threshold. Below the threshold, it logs the numbers and moves on. Above it, the agent posts a summary and a sample of the offending events to the on-call channel and holds. It does not open an incident by itself. The team sees a triaged summary instead of a raw dashboard, and a person decides what happens next.

Central event ingestion

A set of workflows across the business emit lifecycle events. The agent calls Send Event to write each one into Splunk through the HTTP Event Collector, tagging the index and sourcetype the HEC token permits. Operational events from many systems land in one place, searchable alongside application logs.

Saved-search alert with an escalation gate

A saved search that represents a known alert condition runs on a schedule. When Run Saved Search returns rows, the agent assembles the matched events and the search context and posts them to the responding team. It waits for a human to confirm the escalation. Only after an engineer confirms does the flow open an incident in the on-call tool. A saved search fires often; a page does not.

Human-in-Loop Highlight

The human-in-loop moment in Splunk is the escalation gate. Running searches, ingesting events, and reading index health are all safe to automate, so the agent does them by rule and on a schedule. Deciding that a search result is a real incident worth paging a person is a judgment call, so the agent stops. When a scheduled search or a saved-search alert returns results that breach a threshold, the agent posts the metrics summary and a sample of the matched events to the on-call channel and asks: "index=main returned 214 status=500 events in the last 5 minutes, up from a 12-event baseline. Open an incident?" The on-call engineer confirms or dismisses. Only on a confirm does the flow open the incident. The agent watches continuously. A person owns the page.

Agent processes routinely

Detects exception requiring judgment

Clear match Continues automatically

Ambiguous Routes to human via preferred channel

Human decides

Agent resumes with decision

Agent Capabilities

13 actions

Search

Cancel Search Job Cancel a running search job to free resources.
Create Search Job Dispatch an SPL search and return its search ID. Used to start the async poll-and-fetch flow for a large search.
Get Search Job Status Retrieve a search job's status. Polled until the job is done.
Get Search Results Retrieve the results of a completed search job by its search ID.
Run Oneshot Search Run a bounded SPL search and return results in a single call. Used for small, fast searches.

Saved Searches

Get Saved Search Retrieve a saved search definition.
List Saved Searches List the saved searches.
Run Saved Search Run a saved search or alert and return its results.

HTTP Event Collector

Send Event Send a structured event to Splunk through the HTTP Event Collector.
Send Raw Event Send a raw event payload to Splunk through the HTTP Event Collector.

Indexes

Get Index Retrieve an index's size and event count.
List Indexes List the indexes on the instance.

Server

Get Server Info Retrieve server info and health. Used as a connection check.

Start building with Splunk

$100 in credits. No card required. Connect in minutes.

Start Building Free Talk to us