-
Processors
- AttributeRollingWindow
- AttributesToCSV
- AttributesToJSON
- CalculateRecordStats
- CaptureChangeMySQL
- ChangeSQSMessageVisibilityTimeout
- CompressContent
- ConnectWebSocket
- ConsumeAMQP
- ConsumeAzureEventHub
- ConsumeBoxEnterpriseEvents
- ConsumeBoxEvents
- ConsumeElasticsearch
- ConsumeGCPubSub
- ConsumeIMAP
- ConsumeJMS
- ConsumeKafka
- ConsumeKinesis
- ConsumeKinesisStream
- ConsumeMQTT
- ConsumePOP3
- ConsumeSlack
- ConsumeWindowsEventLog
- ControlRate
- ConvertCharacterSet
- ConvertRecord
- CopyAzureBlobStorage_v12
- CopyS3Object
- CountText
- CreateBoxFileMetadataInstance
- CreateBoxMetadataTemplate
- CryptographicHashContent
- DebugFlow
- DecryptContentAge
- DecryptContentPGP
- DeduplicateRecord
- DeleteAzureBlobStorage_v12
- DeleteAzureDataLakeStorage
- DeleteBoxFileMetadataInstance
- DeleteByQueryElasticsearch
- DeleteDynamoDB
- DeleteFile
- DeleteGCSObject
- DeleteGridFS
- DeleteMongo
- DeleteS3Object
- DeleteSFTP
- DeleteSQS
- DetectDuplicate
- DistributeLoad
- DuplicateFlowFile
- EncodeContent
- EncryptContentAge
- EncryptContentPGP
- EnforceOrder
- EvaluateJsonPath
- EvaluateXPath
- EvaluateXQuery
- ExecuteGroovyScript
- ExecuteProcess
- ExecuteScript
- ExecuteSQL
- ExecuteSQLRecord
- ExecuteStreamCommand
- ExtractAvroMetadata
- ExtractEmailAttachments
- ExtractEmailHeaders
- ExtractGrok
- ExtractHL7Attributes
- ExtractRecordSchema
- ExtractStructuredBoxFileMetadata
- ExtractText
- FetchAzureBlobStorage_v12
- FetchAzureBlobStorageMetadata
- FetchAzureBlobStorageTags
- FetchAzureDataLakeStorage
- FetchBoxFile
- FetchBoxFileInfo
- FetchBoxFileMetadataInstance
- FetchBoxFileRepresentation
- FetchDistributedMapCache
- FetchDropbox
- FetchFile
- FetchFTP
- FetchGCSObject
- FetchGoogleDrive
- FetchGridFS
- FetchS3Object
- FetchSFTP
- FetchSmb
- FilterAttribute
- FlattenJson
- ForkEnrichment
- ForkRecord
- GenerateFlowFile
- GenerateRecord
- GenerateTableFetch
- GeoEnrichIP
- GeoEnrichIPRecord
- GeohashRecord
- GetAwsPollyJobStatus
- GetAwsTextractJobStatus
- GetAwsTranscribeJobStatus
- GetAwsTranslateJobStatus
- GetAzureEventHub
- GetAzureQueueStorage_v12
- GetBoxFileCollaborators
- GetBoxGroupMembers
- GetDynamoDB
- GetElasticsearch
- GetFile
- GetFileResource
- GetFTP
- GetGcpVisionAnnotateFilesOperationStatus
- GetGcpVisionAnnotateImagesOperationStatus
- GetHubSpot
- GetMongo
- GetMongoRecord
- GetS3ObjectMetadata
- GetS3ObjectTags
- GetSFTP
- GetShopify
- GetSmbFile
- GetSNMP
- GetSplunk
- GetSQS
- GetWorkdayReport
- GetZendesk
- HandleHttpRequest
- HandleHttpResponse
- IdentifyMimeType
- InvokeHTTP
- InvokeScriptedProcessor
- ISPEnrichIP
- JoinEnrichment
- JoltTransformJSON
- JoltTransformRecord
- JSLTTransformJSON
- JsonQueryElasticsearch
- ListAzureBlobStorage_v12
- ListAzureDataLakeStorage
- ListBoxFile
- ListBoxFileInfo
- ListBoxFileMetadataInstances
- ListBoxFileMetadataTemplates
- ListDatabaseTables
- ListDropbox
- ListenFTP
- ListenHTTP
- ListenOTLP
- ListenSlack
- ListenSyslog
- ListenTCP
- ListenTrapSNMP
- ListenUDP
- ListenUDPRecord
- ListenWebSocket
- ListFile
- ListFTP
- ListGCSBucket
- ListGoogleDrive
- ListS3
- ListSFTP
- ListSmb
- LogAttribute
- LogMessage
- LookupAttribute
- LookupRecord
- MergeContent
- MergeRecord
- ModifyBytes
- ModifyCompression
- MonitorActivity
- MoveAzureDataLakeStorage
- Notify
- PackageFlowFile
- PaginatedJsonQueryElasticsearch
- ParseEvtx
- ParseNetflowv5
- ParseSyslog
- ParseSyslog5424
- PartitionRecord
- PublishAMQP
- PublishGCPubSub
- PublishJMS
- PublishKafka
- PublishMQTT
- PublishSlack
- PutAzureBlobStorage_v12
- PutAzureCosmosDBRecord
- PutAzureDataExplorer
- PutAzureDataLakeStorage
- PutAzureEventHub
- PutAzureQueueStorage_v12
- PutBigQuery
- PutBoxFile
- PutCloudWatchMetric
- PutDatabaseRecord
- PutDistributedMapCache
- PutDropbox
- PutDynamoDB
- PutDynamoDBRecord
- PutElasticsearchJson
- PutElasticsearchRecord
- PutEmail
- PutFile
- PutFTP
- PutGCSObject
- PutGoogleDrive
- PutGridFS
- PutIcebergRecord
- PutKinesisFirehose
- PutKinesisStream
- PutLambda
- PutMongo
- PutMongoBulkOperations
- PutMongoRecord
- PutRecord
- PutRedisHashRecord
- PutS3Object
- PutSalesforceObject
- PutSFTP
- PutSmbFile
- PutSNS
- PutSplunk
- PutSplunkHTTP
- PutSQL
- PutSQS
- PutSyslog
- PutTCP
- PutUDP
- PutWebSocket
- PutZendeskTicket
- QueryAirtableTable
- QueryAzureDataExplorer
- QueryDatabaseTable
- QueryDatabaseTableRecord
- QueryRecord
- QuerySalesforceObject
- QuerySplunkIndexingStatus
- RemoveRecordField
- RenameRecordField
- ReplaceText
- ReplaceTextWithMapping
- RetryFlowFile
- RouteHL7
- RouteOnAttribute
- RouteOnContent
- RouteText
- RunMongoAggregation
- SampleRecord
- ScanAttribute
- ScanContent
- ScriptedFilterRecord
- ScriptedPartitionRecord
- ScriptedTransformRecord
- ScriptedValidateRecord
- SearchElasticsearch
- SegmentContent
- SendTrapSNMP
- SetSNMP
- SignContentPGP
- SplitAvro
- SplitContent
- SplitExcel
- SplitJson
- SplitPCAP
- SplitRecord
- SplitText
- SplitXml
- StartAwsPollyJob
- StartAwsTextractJob
- StartAwsTranscribeJob
- StartAwsTranslateJob
- StartGcpVisionAnnotateFilesOperation
- StartGcpVisionAnnotateImagesOperation
- TagS3Object
- TailFile
- TransformXml
- UnpackContent
- UpdateAttribute
- UpdateBoxFileMetadataInstance
- UpdateByQueryElasticsearch
- UpdateCounter
- UpdateDatabaseTable
- UpdateGauge
- UpdateRecord
- ValidateCsv
- ValidateJson
- ValidateRecord
- ValidateXml
- VerifyContentMAC
- VerifyContentPGP
- Wait
-
Controller Services
- ADLSCredentialsControllerService
- ADLSCredentialsControllerServiceLookup
- ADLSIcebergFileIOProvider
- AmazonGlueEncodedSchemaReferenceReader
- AmazonGlueSchemaRegistry
- AmazonMSKConnectionService
- ApicurioSchemaRegistry
- AvroReader
- AvroRecordSetWriter
- AvroSchemaRegistry
- AWSCredentialsProviderControllerService
- AwsRdsIamDatabasePasswordProvider
- AzureBlobStorageFileResourceService
- AzureCosmosDBClientService
- AzureDataLakeStorageFileResourceService
- AzureEventHubRecordSink
- AzureStorageCredentialsControllerService_v12
- AzureStorageCredentialsControllerServiceLookup_v12
- CEFReader
- ConfluentEncodedSchemaReferenceReader
- ConfluentEncodedSchemaReferenceWriter
- ConfluentProtobufMessageNameResolver
- ConfluentSchemaRegistry
- CSVReader
- CSVRecordLookupService
- CSVRecordSetWriter
- DatabaseRecordLookupService
- DatabaseRecordSink
- DatabaseTableSchemaRegistry
- DBCPConnectionPool
- DBCPConnectionPoolLookup
- DeveloperBoxClientService
- DistributedMapCacheLookupService
- ElasticSearchClientServiceImpl
- ElasticSearchLookupService
- ElasticSearchStringLookupService
- EmailRecordSink
- EmbeddedHazelcastCacheManager
- ExcelReader
- ExternalHazelcastCacheManager
- FreeFormTextRecordSetWriter
- GcpCloudSqlIamDatabasePasswordProvider
- GCPCredentialsControllerService
- GCSFileResourceService
- GCSIcebergFileIOProvider
- GrokReader
- HazelcastMapCacheClient
- HikariCPConnectionPool
- HttpRecordSink
- IPLookupService
- JettyWebSocketClient
- JettyWebSocketServer
- JMSConnectionFactoryProvider
- JndiJmsConnectionFactoryProvider
- JsonConfigBasedBoxClientService
- JsonPathReader
- JsonRecordSetWriter
- JsonTreeReader
- JWTBearerOAuth2AccessTokenProvider
- Kafka3ConnectionService
- KerberosKeytabUserService
- KerberosPasswordUserService
- KerberosTicketCacheUserService
- LoggingRecordSink
- MapCacheClientService
- MapCacheServer
- MongoDBControllerService
- MongoDBLookupService
- ParquetIcebergWriter
- PEMEncodedSSLContextProvider
- PropertiesFileLookupService
- ProtobufReader
- ReaderLookup
- RecordSetWriterLookup
- RecordSinkServiceLookup
- RedisConnectionPoolService
- RedisDistributedMapCacheClientService
- RESTIcebergCatalog
- RestLookupService
- S3FileResourceService
- S3IcebergFileIOProvider
- ScriptedLookupService
- ScriptedReader
- ScriptedRecordSetWriter
- ScriptedRecordSink
- SetCacheClientService
- SetCacheServer
- SimpleCsvFileLookupService
- SimpleDatabaseLookupService
- SimpleKeyValueLookupService
- SimpleRedisDistributedMapCacheClientService
- SimpleScriptedLookupService
- SiteToSiteReportingRecordSink
- SlackRecordSink
- SmbjClientProviderService
- StandardAzureCredentialsControllerService
- StandardAzureIdentityFederationTokenProvider
- StandardDatabaseDialectService
- StandardDropboxCredentialService
- StandardFileResourceService
- StandardHashiCorpVaultClientService
- StandardHttpContextMap
- StandardJsonSchemaRegistry
- StandardKustoIngestService
- StandardKustoQueryService
- StandardOauth2AccessTokenProvider
- StandardPGPPrivateKeyService
- StandardPGPPublicKeyService
- StandardPrivateKeyService
- StandardProtobufReader
- StandardProxyConfigurationService
- StandardRestrictedSSLContextService
- StandardS3EncryptionService
- StandardSSLContextService
- StandardWebClientServiceProvider
- Syslog5424Reader
- SyslogReader
- UDPEventRecordSink
- VolatileSchemaCache
- WindowsEventLogReader
- XMLFileLookupService
- XMLReader
- XMLRecordSetWriter
- YamlTreeReader
- ZendeskRecordSink
GetSplunk 2.12.0
- Bundle
- org.apache.nifi | nifi-splunk-nar
- Description
- Retrieves data from Splunk Enterprise.
- Tags
- get, logs, splunk
- Input Requirement
- FORBIDDEN
- Supports Sensitive Dynamic Properties
- false
Properties
-
API Version
Select which version of the Splunk Search API to use for search operations. Version 2 is recommended for newer Splunk instances.
- Display Name
- API Version
- Description
- Select which version of the Splunk Search API to use for search operations. Version 2 is recommended for newer Splunk instances.
- API Name
- API Version
- Default Value
- V2
- Allowable Values
-
- API Version 2
- API Version 1
- Expression Language Scope
- Not Supported
- Sensitive
- false
- Required
- true
-
Application
The Splunk Application to query.
- Display Name
- Application
- Description
- The Splunk Application to query.
- API Name
- Application
- Expression Language Scope
- Not Supported
- Sensitive
- false
- Required
- false
-
Connection Timeout
Max wait time for connection to the Splunk server.
- Display Name
- Connection Timeout
- Description
- Max wait time for connection to the Splunk server.
- API Name
- Connection Timeout
- Default Value
- 5 secs
- Expression Language Scope
- Not Supported
- Sensitive
- false
- Required
- false
-
Earliest Time
The value to use for the earliest time when querying. Only used with a Time Range Strategy of Provided. See Splunk's documentation on Search Time Modifiers for guidance in populating this field.
- Display Name
- Earliest Time
- Description
- The value to use for the earliest time when querying. Only used with a Time Range Strategy of Provided. See Splunk's documentation on Search Time Modifiers for guidance in populating this field.
- API Name
- Earliest Time
- Expression Language Scope
- Not Supported
- Sensitive
- false
- Required
- false
-
Hostname
The ip address or hostname of the Splunk server.
- Display Name
- Hostname
- Description
- The ip address or hostname of the Splunk server.
- API Name
- Hostname
- Default Value
- localhost
- Expression Language Scope
- Not Supported
- Sensitive
- false
- Required
- true
-
Latest Time
The value to use for the latest time when querying. Only used with a Time Range Strategy of Provided. See Splunk's documentation on Search Time Modifiers for guidance in populating this field.
- Display Name
- Latest Time
- Description
- The value to use for the latest time when querying. Only used with a Time Range Strategy of Provided. See Splunk's documentation on Search Time Modifiers for guidance in populating this field.
- API Name
- Latest Time
- Expression Language Scope
- Not Supported
- Sensitive
- false
- Required
- false
-
Output Mode
The output mode for the results.
- Display Name
- Output Mode
- Description
- The output mode for the results.
- API Name
- Output Mode
- Default Value
- JSON
- Allowable Values
-
- ATOM
- CSV
- JSON
- JSON_COLS
- JSON_ROWS
- RAW
- XML
- Expression Language Scope
- Not Supported
- Sensitive
- false
- Required
- true
-
Owner
The owner to pass to Splunk.
- Display Name
- Owner
- Description
- The owner to pass to Splunk.
- API Name
- Owner
- Expression Language Scope
- Not Supported
- Sensitive
- false
- Required
- false
-
Password
The password to authenticate to Splunk.
- Display Name
- Password
- Description
- The password to authenticate to Splunk.
- API Name
- Password
- Expression Language Scope
- Not Supported
- Sensitive
- true
- Required
- false
-
Port
The port of the Splunk server.
- Display Name
- Port
- Description
- The port of the Splunk server.
- API Name
- Port
- Default Value
- 8089
- Expression Language Scope
- Not Supported
- Sensitive
- false
- Required
- true
-
Query
The query to execute. Typically beginning with a <search> command followed by a search clause, such as <search source="tcp:7689"> to search for messages received on TCP port 7689.
- Display Name
- Query
- Description
- The query to execute. Typically beginning with a <search> command followed by a search clause, such as <search source="tcp:7689"> to search for messages received on TCP port 7689.
- API Name
- Query
- Default Value
- search * | head 100
- Expression Language Scope
- Not Supported
- Sensitive
- false
- Required
- true
-
Read Timeout
Max wait time for response from the Splunk server.
- Display Name
- Read Timeout
- Description
- Max wait time for response from the Splunk server.
- API Name
- Read Timeout
- Default Value
- 15 secs
- Expression Language Scope
- Not Supported
- Sensitive
- false
- Required
- false
-
Scheme
The scheme for connecting to Splunk.
- Display Name
- Scheme
- Description
- The scheme for connecting to Splunk.
- API Name
- Scheme
- Default Value
- https
- Allowable Values
-
- https
- http
- Expression Language Scope
- Not Supported
- Sensitive
- false
- Required
- true
-
Security Protocol
The security protocol to use for communicating with Splunk.
- Display Name
- Security Protocol
- Description
- The security protocol to use for communicating with Splunk.
- API Name
- Security Protocol
- Default Value
- TLSv1_2
- Allowable Values
-
- TLSv1_2
- TLSv1_1
- TLSv1
- SSLv3
- Expression Language Scope
- Not Supported
- Sensitive
- false
- Required
- false
-
SSL Context Service
The SSL Context Service used to provide client certificate information for TLS/SSL connections.
- Display Name
- SSL Context Service
- Description
- The SSL Context Service used to provide client certificate information for TLS/SSL connections.
- API Name
- SSL Context Service
- Service Interface
- org.apache.nifi.ssl.SSLContextProvider
- Service Implementations
- Expression Language Scope
- Not Supported
- Sensitive
- false
- Required
- false
-
Time Field Strategy
Indicates whether to search by the time attached to the event, or by the time the event was indexed in Splunk.
- Display Name
- Time Field Strategy
- Description
- Indicates whether to search by the time attached to the event, or by the time the event was indexed in Splunk.
- API Name
- Time Field Strategy
- Default Value
- Event Time
- Allowable Values
-
- Event Time
- Index Time
- Expression Language Scope
- Not Supported
- Sensitive
- false
- Required
- true
-
Time Range Strategy
Indicates how to apply time ranges to each execution of the query. Selecting a managed option allows the processor to apply a time range from the last execution time to the current execution time. When using <Managed from Beginning>, an earliest time will not be applied on the first execution, and thus all records searched. When using <Managed from Current> the earliest time of the first execution will be the initial execution time. When using <Provided>, the time range will come from the Earliest Time and Latest Time properties, or no time range will be applied if these properties are left blank.
- Display Name
- Time Range Strategy
- Description
- Indicates how to apply time ranges to each execution of the query. Selecting a managed option allows the processor to apply a time range from the last execution time to the current execution time. When using <Managed from Beginning>, an earliest time will not be applied on the first execution, and thus all records searched. When using <Managed from Current> the earliest time of the first execution will be the initial execution time. When using <Provided>, the time range will come from the Earliest Time and Latest Time properties, or no time range will be applied if these properties are left blank.
- API Name
- Time Range Strategy
- Default Value
- Provided
- Allowable Values
-
- Managed from Beginning
- Managed from Current
- Provided
- Expression Language Scope
- Not Supported
- Sensitive
- false
- Required
- true
-
Time Zone
The Time Zone to use for formatting dates when performing a search. Only used with Managed time strategies. The value must be a valid Java time zone identifier, such as UTC or America/New_York.
- Display Name
- Time Zone
- Description
- The Time Zone to use for formatting dates when performing a search. Only used with Managed time strategies. The value must be a valid Java time zone identifier, such as UTC or America/New_York.
- API Name
- Time Zone
- Default Value
- UTC
- Expression Language Scope
- Not Supported
- Sensitive
- false
- Required
- true
-
Token
The token to pass to Splunk.
- Display Name
- Token
- Description
- The token to pass to Splunk.
- API Name
- Token
- Expression Language Scope
- Not Supported
- Sensitive
- false
- Required
- false
-
Username
The username to authenticate to Splunk.
- Display Name
- Username
- Description
- The username to authenticate to Splunk.
- API Name
- Username
- Expression Language Scope
- Not Supported
- Sensitive
- false
- Required
- false
State Management
| Scopes | Description |
|---|---|
| CLUSTER | If using one of the managed Time Range Strategies, this processor will store the values of the latest and earliest times from the previous execution so that the next execution of the can pick up where the last execution left off. The state will be cleared and start over if the query is changed. |
Relationships
| Name | Description |
|---|---|
| success | Results retrieved from Splunk are sent out this relationship. |
Writes Attributes
| Name | Description |
|---|---|
| splunk.query | The query that performed to produce the FlowFile. |
| splunk.earliest.time | The value of the earliest time that was used when performing the query. |
| splunk.latest.time | The value of the latest time that was used when performing the query. |