Trigger Kestra Flows from Splunk Alerts

The Kestra Add-on for Splunk adds a Trigger Kestra Flow alert action that starts Kestra flows when a saved search fires.

When an alert fires, the add-on calls the Kestra Executions API with a Bearer token, forwarding alert metadata and search results as flow inputs. No webhook URL required — the token is stored encrypted in Splunk’s credential store.

This guide covers the Kestra-side setup: creating an API token, designing a receiving flow, and wiring up the alert action fields. For Splunk-side installation, see the TA-kestra README.

Prerequisites

• Kestra Enterprise Edition with at least one namespace and a service account or user API token with EXECUTION:CREATE permission on the target namespace.
• Splunk Enterprise or Splunk Cloud with the TA-kestra add-on installed. See Installation in the add-on README.
• A saved search with a trigger condition. Any search that produces results can be used as a trigger.

Step 1: Create a Kestra API token

The add-on authenticates with Kestra using a Bearer token stored encrypted in Splunk’s credential store. Create a dedicated token for the integration.

In the Kestra UI, open Administration → API Tokens and create a new token scoped to the service account or user that has EXECUTION:CREATE on the target namespace.

Copy the full token value now — it is shown only once.

See API Tokens for token creation and rotation details.

Step 2: Configure a Kestra connection in the add-on

The add-on stores Kestra credentials as named connections. Each connection holds a base URL and an API token. Alert actions reference a connection by name, so you configure the URL and token once per Kestra instance.

In Splunk Web, go to Apps → Kestra Add-on for Splunk → Configuration → Kestra Connections → Add and fill in:

Step 3: Design the receiving flow

Create a flow in the target namespace with inputs that match what the alert action will send.

All flow inputs from the alert action are optional at the Kestra API level, so declare them with required: false unless you want Kestra to reject executions that omit them.

id: splunk-alert-handler
namespace: company.ops

inputs:
  # From "Input mapping" — map any result field or alert token
  - id: severity
    type: STRING
    required: false

  - id: src_host
    type: STRING
    required: false

  # From "Send alert metadata" (enabled by default)
  - id: splunk_search_name
    type: STRING
    required: false

  - id: splunk_sid
    type: STRING
    required: false

  - id: splunk_owner
    type: STRING
    required: false

  - id: splunk_app
    type: STRING
    required: false

  - id: splunk_results_link
    type: STRING
    required: false

  - id: splunk_trigger_time
    type: STRING
    required: false

  # From "Attach results file" (enabled by default)
  - id: results
    type: FILE
    required: false

tasks:
  - id: triage
    type: io.kestra.plugin.core.log.Log
    message: |
      Alert '{{ inputs.splunk_search_name }}' fired at {{ inputs.splunk_trigger_time }}.
      Severity: {{ inputs.severity }} — host: {{ inputs.src_host }}

What the add-on sends

The alert action has three input sources, all controlled by the alert configuration:

Alert metadata (sent when Send alert metadata is on, which is the default):

Input mapping (free-form, one flow_input=$token$ per line):

Map any Splunk alert token or search result field to a named flow input. Splunk resolves the tokens before passing them to the handler.

severity=$result.severity$
src_host=$result.src_host$
search_name=$name$

$result.fieldname$ picks the value from the first matching result row. $name$ is the saved search name (same as splunk_search_name, useful when you want a shorter input name).

Results file (sent when Attach results file is on, which is the default):

The full search results CSV is attached as a FILE input named results. Declare it as type: FILE in your flow if you want to process it.

Step 4: Attach the alert action

Open the saved search in Splunk, go to Edit → Edit Alert, and under Trigger Actions click + Add Actions → Trigger Kestra Flow.

Fill in the action fields:

Step 5: Verify the integration

When the alert fires, the add-on logs the created execution ID and a link to it in the alert action log:

Kestra execution created: id=<execution-id> url=https://kestra.corp.example.com/ui/main/executions/company.ops/splunk-alert-handler/<execution-id>

Open the execution in Kestra to confirm the inputs arrived and the flow completed.

If the execution is not created, check the modalert log in Splunk at $SPLUNK_HOME/var/log/splunk/trigger_kestra_flow_modalert.log. Common errors and their fixes:

The add-on makes up to three attempts on 5xx responses and transient network errors, with backoff between retries. The API token is never written to logs.

Related

• TA-kestra add-on source and installation
• Kestra API Tokens
• Trigger flows via the Kestra API
• Log Shipper — the reverse direction: ship Kestra logs into Splunk