# Splunk (/docs/integrations/splunk) Splunk [#splunk] The Splunk app is a service integration in RawTree Cloud and RawTree BYOC, where enabled. RawTree stores the events and executes the translated SQL. The Splunk app provides Splunk HTTP Event Collector (HEC)-compatible ingestion and a platform-native SPL search experience. You do not need to install a Splunk search provider, command, forwarder, or add-on to query the ingested events. Before using these endpoints, open the cluster in the service dashboard, select **Apps**, and install **Splunk**. Installation enables HEC ingestion, SPL execution, and saved searches for the cluster. It does not start or resume the cluster, so the cluster must also be available. HEC ingestion [#hec-ingestion] Use a writable cluster API key as the HEC token and select the destination database with the `database` query parameter: ```bash export RAWTREE_URL=https://api.rawtree.com export RAWTREE_API_KEY=rt_... export RAWTREE_DATABASE=analytics curl -X POST "$RAWTREE_URL/splunk/services/collector/event?database=$RAWTREE_DATABASE" \ -H "Authorization: Splunk $RAWTREE_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "time": 1710000000, "host": "web-01", "source": "nginx", "sourcetype": "access_combined", "index": "main", "event": {"status": 200, "path": "/health", "duration_ms": 12} }' ``` The service creates the `splunk_events` table on the first successful insert. Event object fields and HEC metadata are queryable as top-level fields. The Splunk app also adds `_time` and retains the original HEC envelope in `_hec`. The HEC `index` field is searchable metadata; it does not create another RawTree table. The supported HEC endpoints are: | Endpoint | Purpose | | ------------------------------------------- | -------------------------------------------------------------------------------------------------------- | | `POST /splunk/services/collector` | Ingest one or more HEC event envelopes. | | `POST /splunk/services/collector/event` | Ingest one or more HEC event envelopes. | | `POST /splunk/services/collector/raw` | Ingest newline-delimited raw events. Requires a UUID channel in `X-Splunk-Request-Channel` or `channel`. | | `GET /splunk/services/collector/health` | Check HEC connectivity. | | `GET /splunk/services/collector/health/1.0` | Check HEC connectivity using the versioned path. | Search with SPL [#search-with-spl] Open **Splunk** under **Apps** in the sidebar to create, run, and save SPL searches in the service dashboard. Searches run directly against `splunk_events`, and results include a timeline plus row-count feedback for supported pipeline stages. Saved searches default to private and can be shared explicitly with other authorized members of the organization. Their time window and selected table or chart presentation are restored when reopened. All members with access to the cluster can edit shared searches. To preserve a completed result, open the search actions menu and choose **Create a snapshot**. Each capture stores an independent copy of the returned rows and visualization, up to 16 MiB. Snapshots appear alongside saved searches in the **Private** or **Shared** sidebar tab, inheriting the source search's visibility when created. Use **Permissions** to change a snapshot's visibility independently. Shared snapshots remain authenticated cluster resources; copying a link does not make them public. Opening a snapshot does not rerun its query. Its captured results, source name, description, and time window survive changes to the underlying data or deletion of the saved search. Deleting a snapshot does not delete its source search or other captures. While editing a search, **Live results** is enabled by default. The dashboard waits 800 milliseconds after the last SPL or time-window change. It then reruns the complete draft and replaces the result when that run succeeds. The dashboard cancels superseded runs. The last successful result remains visible while an update runs. Incomplete or unsupported draft SPL does not clear that result. Use `Cmd+Enter` on macOS or `Ctrl+Enter` on Windows and Linux to run immediately. The editor loads the backend's supported SPL commands, functions, operators, and syntax once, then computes suggestions locally as you type. Field suggestions come from the selected database's `splunk_events` schema and the latest successful search result. After a field comparison such as `attack_type=c` or `attack_type="c`, the editor also suggests that field's common values from available search-result field statistics. These suggestions work in search filters and `where` stages, including inside single or double quotes. Selecting a value handles quoting and escaping automatically. Suggestions are computed locally from available statistics, not by querying all distinct values on each keystroke. Live results means debounced reruns of complete SPL; it does not stream partial rows from one running RawTree query. This keeps aggregate commands such as `stats` and `timechart` internally consistent while still shortening the edit, run, and inspect loop. You can also execute a read-only search through the API: ```bash curl -X POST \ "$RAWTREE_URL/v1/spl/search?database=$RAWTREE_DATABASE" \ -H "Authorization: Bearer $RAWTREE_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "spl": "index=main status>=500 | stats count by host | sort - count", "earliest": "-30m", "latest": "now" }' ``` The supported SPL subset includes base filters; `search` and `where`; positive `fields` and `table`; `rename`; bounded `eval`; `stats`; `chart`; `sort`; `head`; multi-field `dedup`; and `timechart`. Unsupported or ambiguous commands return `400` instead of being passed through as SQL. Searches use **Smart mode**. Event-preserving commands such as `search`, `where`, and `fields` show **Raw events** and a timeline. Transforming commands—`stats`, `chart`, `timechart`, and `table`—show **Results** without fetching an additional event list or timeline, whether you are editing or viewing the search. `table` selects columns; use `stats count BY rule_id`, not `table count BY rule_id`, to count events per rule. Fast and Verbose mode selectors are not currently exposed. `stats count BY action country` returns one row per combination. In contrast, `chart count OVER action BY country` returns one row per action with a column for each country. Split `timechart` searches also return real series columns, so subsequent commands can use them directly: ```spl index=main | timechart span=5m count BY country | where US>0 | table _time US ``` Supported aggregates include `count`, `dc`, `sum`, `avg`, `values`, `min`, `max`, `earliest`, `latest`, and conditional counts such as `count(eval(status>=500))`. `timechart` accepts multiple aggregates, automatically selects a span when none is supplied, and fills missing time buckets by default. Use `cont=false` for observed buckets only. Counts fill with zero; absent numeric aggregates remain null. The existing five visualization types and captured snapshots remain available. The search response includes the result rows, the original SPL, timeline buckets, pipeline-stage feedback, result kind, truncation state, and query statistics. For the complete request and response contract, supported aggregations, time-window syntax, cancellation, and saved-search endpoints, see the [Splunk and SPL search API reference](/docs/reference/api/apps/splunk).