Articles in this section

Available Splunk DI objects

Rachel Shanthi Bijja
Updated

The following objects are available when using Splunk as a source in Celigo Data Integration (DI).

Primary key: Splunk DI endpoints use Atom feed fields as the primary key — fired alerts key on string id; data indexes and data inputs key on title (the resource name).

Note

Splunk hard deletes configuration objects when they are removed (for example indexes and data inputs). DELETE/remove physically drops those objects from configuration and deleted records are not retrievable via the list APIs; indexes may also be disabled rather than removed. Celigo syncs all data returned by the source as-is.

Object API endpoint Available extract modes Delta field
Alerts Access all fired alerts Full —
Indexes List data indexes Full —
Inputs List all data inputs Full —

Response schemas

Click an object below to view its response fields and delta configuration.

Alerts — Access all fired alerts

Response schema:

Field Type
id string (Primary key)
title string
updated string
published string
link object
content object
author object
author.name string
Indexes — List data indexes

Response schema:

Field Type
title string (Primary key)
id string
updated string
published string
link object
content object
author object
author.name string
Inputs — List all data inputs

Response schema:

Field Type
title string (Primary key)
id string
updated string
published string
link object
content object
author object
author.name string