DigitalOcean
DigitalOcean is the developer cloud, offering droplets, managed databases, and Kubernetes. With Kestra's dedicated plugin, teams orchestrate the whole account with event-driven flows.
Splunk
Splunk is where teams watch their infrastructure and security. Kestra runs what happens next: a Splunk alert starts a flow that fixes the problem, opens the ticket, asks for approval and records every step.
About
The Kestra Add-on for Splunk adds a Trigger Kestra Flow alert action to Splunk. It went through the Splunkbase review and runs on Splunk Enterprise and Splunk Cloud Platform. Customers running Kestra next to Splunk asked for it, to replace the scripts and webhooks they had wired between the two. The setup guide covers the connection, the token and the receiving flow, and the announcement tells the story.
Splunk + Kestra: detection in Splunk, response in Kestra
A Splunk alert starts a flow
Add the Trigger Kestra Flow action to any alert and pick the tenant, namespace and flow. When the search fires, Splunk calls the Kestra Executions API, with no polling script or open webhook.
The alert context travels with it
Search name, owner, trigger time and a link to the results arrive as flow inputs. Map any result field with a line such as host=$result.host$, and get the full results as a CSV file.
One connection, tokens encrypted
Set up each Kestra instance once and reuse it across alerts. The API token sits encrypted in Splunk's credential store, never in a config file or a log.
Alert owners don't need admin rights
The add-on ships a kestra_alert_user role, so the people who own alerts can run the action without a Splunk admin account.
A response with an owner and an approval
The flow fixes the problem, opens the ticket and waits for a human to approve, and every step is recorded.
Results go back to Splunk
Flows send events through the HTTP Event Collector, run SPL searches and ship execution logs, so Splunk keeps the full record.
