Splunk

RawTree provides Splunk HTTP Event Collector (HEC)-compatible ingestion and a platform-native SPL search experience. You do not need to install a Splunk search provider, command, forwarder, or add-on to query the ingested events.

Before using these endpoints, open the cluster in the RawTree platform, select Apps, and install Splunk. Installation enables HEC ingestion, SPL execution, and saved searches for the cluster. It does not start or resume the cluster, so the cluster must also be available.

HEC ingestion

Use a writable cluster API key as the HEC token and select the destination database with the database query parameter:

export RAWTREE_URL=https://api.rawtree.com
export RAWTREE_API_KEY=rt_...
export RAWTREE_DATABASE=analytics

curl -X POST "$RAWTREE_URL/splunk/services/collector/event?database=$RAWTREE_DATABASE" \
  -H "Authorization: Splunk $RAWTREE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "time": 1710000000,
    "host": "web-01",
    "source": "nginx",
    "sourcetype": "access_combined",
    "index": "main",
    "event": {"status": 200, "path": "/health", "duration_ms": 12}
  }'

RawTree creates the splunk_events table on the first successful insert. Event object fields and HEC metadata are queryable as top-level fields. RawTree also adds _time and retains the original HEC envelope in _hec. The HEC index field is searchable metadata; it does not create another RawTree table.

The supported HEC endpoints are:

Search with SPL

Open Splunk under Apps in the sidebar to create, run, and save SPL searches in the RawTree platform. Searches run directly against splunk_events, and results include a timeline plus row-count feedback for supported pipeline stages. Saved searches default to private and can be shared explicitly with other authorized members of the organization. Their time window and selected table or chart presentation are restored when reopened. All members with access to the cluster can edit shared searches.

To preserve a completed result, open the search actions menu and choose Create a snapshot. Each capture stores an independent copy of the returned rows and visualization, up to 16 MiB. Snapshots appear alongside saved searches in the Private or Shared sidebar tab, inheriting the source search's visibility when created. Use Permissions to change a snapshot's visibility independently. Shared snapshots remain authenticated cluster resources; copying a link does not make them public.

Opening a snapshot does not rerun its query. Its captured results, source name, description, and time window survive changes to the underlying data or deletion of the saved search. Deleting a snapshot does not delete its source search or other captures.

While editing a search, Live results is enabled by default. RawTree waits 800 milliseconds after the last SPL or time-window change, then reruns the complete draft and replaces the result when that run succeeds. Superseded runs are cancelled, the last successful result remains visible while an update is running, and incomplete or unsupported draft SPL does not clear that result. Use Cmd+Enter on macOS or Ctrl+Enter on Windows and Linux to run immediately.

The editor loads the backend's supported SPL commands, functions, operators, and syntax once, then computes suggestions locally as you type. Field suggestions come from the selected database's splunk_events schema and the latest successful search result. After a field comparison such as attack_type=c or attack_type="c, the editor also suggests that field's common values from available search-result field statistics. These suggestions work in search filters and where stages, including inside single or double quotes. Selecting a value handles quoting and escaping automatically. Suggestions are computed locally from available statistics, not by querying all distinct values on each keystroke.

Live results means debounced reruns of complete SPL; it does not stream partial rows from one running ClickHouse query. This keeps aggregate commands such as stats and timechart internally consistent while still shortening the edit, run, and inspect loop.

You can also execute a read-only search through the API:

curl -X POST \
  "$RAWTREE_URL/v1/spl/search?database=$RAWTREE_DATABASE" \
  -H "Authorization: Bearer $RAWTREE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "spl": "index=main status>=500 | stats count by host | sort - count",
    "earliest": "-30m",
    "latest": "now"
  }'

The supported SPL subset includes base filters; search and where; positive fields and table; rename; bounded eval; stats; chart; sort; head; multi-field dedup; and timechart. Unsupported or ambiguous commands return 400 instead of being passed through as SQL.

Searches use Smart mode. Event-preserving commands such as search, where, and fields show Raw events and a timeline. Transforming commands—stats, chart, timechart, and table—show Results without fetching an additional event list or timeline, whether you are editing or viewing the search. table selects columns; use stats count BY rule_id, not table count BY rule_id, to count events per rule. Fast and Verbose mode selectors are not currently exposed.

stats count BY action country returns one row per combination. In contrast, chart count OVER action BY country returns one row per action with a column for each country. Split timechart searches also return real series columns, so subsequent commands can use them directly:

index=main | timechart span=5m count BY country | where US>0 | table _time US

Supported aggregates include count, dc, sum, avg, values, min, max, earliest, latest, and conditional counts such as count(eval(status>=500)). timechart accepts multiple aggregates, automatically selects a span when none is supplied, and fills missing time buckets by default. Use cont=false for observed buckets only. Counts fill with zero; absent numeric aggregates remain null. The existing five visualization types and captured snapshots remain available.

The search response includes the result rows, the original SPL, timeline buckets, pipeline-stage feedback, result kind, truncation state, and query statistics. For the complete request and response contract, supported aggregations, time-window syntax, cancellation, and saved-search endpoints, see the Splunk and SPL search API reference.