Splunk
CertifiedEnterprise EditionTasks that send Kestra logs to Splunk via HTTP Event Collector for centralized search and monitoring.
Use when forwarding workflow logs to Splunk HEC; requires the HEC base URL and token. Supports batching (default 1,000 events) and optional HTTP client settings for TLS, proxies, and timeouts.
Splunk
Tasks that send Kestra logs to Splunk via HTTP Event Collector for centralized search and monitoring.
Use when forwarding workflow logs to Splunk HEC; requires the HEC base URL and token. Supports batching (default 1,000 events) and optional HTTP client settings for TLS, proxies, and timeouts.
tasks
How to use the Splunk plugin
Send events to Splunk, search Splunk, and ship Kestra execution logs to Splunk from Kestra flows.
Authentication
All tasks require host (required, the Splunk hostname). Tasks that write to HEC require token (the HEC token). events.Search authenticates via token (bearer) or username + password (Basic auth). Store secrets in secrets and apply connection properties globally with plugin defaults.
Tasks
events.Send sends one or more events to Splunk HEC — set host and token (both required). Provide event content via eventData (inline string) or inputFile (a kestra:// URI). Optionally set port (default 443), scheme (default https), index, sourcetype, source, and hostField. The output includes statusCode and statusMessage.
events.Search runs a SPL query against the Splunk management API — set host (required) and query (required). Authenticate via token (bearer) or username + password. Optionally set port (default 8089), scheme (default https), outputMode (default JSON), batchSize (default 10000), pollIntervalSeconds (default 2), and maxWaitSeconds (default 3600). The output includes uri (ION file of results), resultCount, and sid.
Log exporters
LogExporter ships execution logs to Splunk HEC in batches — set host and token (both required). Optionally set source (default Kestra), chunk (logs per request, default 1000), and options for HTTP client configuration.
