Cisco Splunk

Cisco Splunk is a powerful data analytics and monitoring platform designed for searching, analyzing, and visualizing machine-generated data from applications, systems, and IT infrastructure in real-time. As a comprehensive security information and event management (SIEM) solution, Splunk enables organizations to gain operational intelligence, perform security monitoring, troubleshoot issues, and analyze log data across their entire technology stack.

Category	SIEM
Direction	Query source
Sign-in	Username and Password, Authentication Token
Query languages	SQLite, STIX, SPL
Tables	6
Query templates	28

Before you start

Huntbase can sign in to Cisco Splunk with any of these methods: Username and Password, Authentication Token. Pick one, create the credential in Cisco Splunk, then keep it to hand for the Connect step.

Authentication Token

Authenticate using a Splunk authentication token.

1. In Splunk Web, go to Settings › Tokens. If you see a message that token authentication is not enabled, enable it.
2. Click New Token. In User, enter the Splunk user the token acts as, and in Audience, describe its purpose.
3. Optionally, set an Expiration, then click Create.
4. Copy the token before you click Close. You cannot see it again.

Permissions:

• To create tokens you need edit_tokens_own (tokens for yourself) or edit_tokens_all (tokens for any user).

Watch out for

• The token has the permissions of the user it is created for. Choose a user who can search the indexes you want to query.

For the vendor's own instructions, see Splunk token documentation.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect Cisco Splunk

1. Go to Connections and click New connection, or click New connection on the Cisco Splunk product page.
2. On Product, pick Cisco Splunk and choose the Owner.
3. On Details, give the connection a Name and, optionally, a Description.
4. On Connect, fill in the settings and credentials described below.
5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings

Where your Cisco Splunk lives:

Field	Required	Notes
Splunk URL	No	The Splunk management endpoint, such as https://splunk.example.com:8089. Use the management port (default 8089), not the web UI port.
Server Address	Yes	Specify the IP address or hostname of the data source.
Port	Yes	The Splunk management port, usually 8089. Defaults to 8089.

Advanced settings

These settings are under Advanced. You can usually leave them alone.

Field	Required	Notes
Max Results	No	Advanced. Maximum rows fetched per run (connector default 10000). Lower for large result sets to keep responses fast and avoid timeouts.
Query Timeout (seconds)	No	Advanced. Per-request timeout for the Splunk search API (connector default 30s). Raise for slow or heavily-loaded deployments.
Self-Signed Cert (PEM)	No	Provide a self-signed or CA-signed certificate to securely communicate with the data source.

Credentials

Choose a Method, enter a Credential label (for example Production), then fill in the fields for that method.

Username and Password

Field	Required	Notes
Username	Yes	Secret — not shown again after you save it.
Password	Yes	Secret — not shown again after you save it.

Authentication Token

Field	Required	Notes
Authentication Token	Yes	Secret — not shown again after you save it.

Query it

Once connected, Cisco Splunk can serve these languages in a query tab, and Scout can use it when you ask in Auto:

Language	Use it for
SQLite	SQL over the 6 tables listed below, alongside every other connected source.
STIX	STIX patterns for indicator sweeps, translated into the product's native search.
SPL	Native Splunk searches, sent as written.

Example: SQLite

Splunk Apps Basic Info — Retrieve basic details of Splunk applications such as their names, versions, and authors.

SELECT
  name,
  version,
  author
FROM
  splunk_app;

Example: STIX

Suspicious URL or IP across events — Hunt for a suspicious URL or IP address across indexed events using a STIX pattern.

[url:value = '{{suspicious_url}}'] OR [ipv4-addr:value = '{{suspicious_ipv4}}']

Example: SPL

Failed authentications for a user — Raw SPL passthrough to retrieve recent failed authentication events for a user.

search index=* sourcetype=*auth* action=failure user={{username}} | head 100

Cisco Splunk ships with 28 query templates. Find them in Library › Queries — see Query templates.

Tables

Cisco Splunk adds 6 tables. Browse their columns from Schema in the query bar's ⋯ menu.

All 6 tables

Table	Contains
splunk_app	List all apps installed locally.
splunk_index	List all indexes installed locally.
splunk_search_job	List all search jobs.
splunk_search_job_result	List results for a given search job.
splunk_token	List all tokens.
splunk_user	List all users.

Next steps

• Connections — health, credentials and settings after you connect
• Query languages — syntax, parameters and time ranges
• Chatting with Scout — ask questions without writing a query
• All integrations — the rest of the catalog