feat(splunk): full Splunk REST integration (search, jobs, KV Store, events)

20 commands over the management port (8089) with token or basic auth:
SPL search (oneshot) as an ingestion source with an OCSF mapper for
notable/CIM findings; async search jobs (create/status/results); index
listing; event submission (receivers/simple + HEC); the complete KV Store
command set (collection create/config/delete, list, data list/add/delete,
entry search/delete/update); user list/delete; and a connectivity test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

integrations/splunk/scripts/delete_user.py

@@ -0,0 +1,83 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    user = I["username"]
+    res = req("DELETE", "/services/authentication/users/" + qq(user),
+              params={"output_mode": "json"})
+    out({"deleted": user, "result": res})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/get_indexes.py

@@ -0,0 +1,86 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    res = req("GET", "/services/data/indexes", params={"output_mode": "json", "count": "-1"})
+    indexes = []
+    for e in res.get("entry", []):
+        c = e.get("content", {})
+        indexes.append({"name": e.get("name"), "totalEventCount": c.get("totalEventCount"),
+                        "currentDBSizeMB": c.get("currentDBSizeMB"), "disabled": c.get("disabled")})
+    out({"indexes": indexes})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/get_users.py

@@ -0,0 +1,87 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    res = req("GET", "/services/authentication/users", params={"output_mode": "json", "count": "-1"})
+    users = []
+    for e in res.get("entry", []):
+        c = e.get("content", {})
+        users.append({"name": e.get("name"), "realname": c.get("realname"),
+                      "email": c.get("email"), "roles": c.get("roles"),
+                      "type": c.get("type"), "locked-out": c.get("locked-out")})
+    out({"users": users})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/job_create.py

@@ -0,0 +1,90 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    q = (I.get("query") or "").strip()
+    if not (q.lower().startswith("search ") or q.startswith("|")):
+        q = "search " + q
+    data = {"search": q, "output_mode": "json"}
+    if I.get("earliest"):
+        data["earliest_time"] = I["earliest"]
+    if I.get("latest"):
+        data["latest_time"] = I["latest"]
+    path = "/servicesNS/nobody/" + qq(_app()) + "/search/jobs"
+    res = req("POST", path, data=data)
+    out({"sid": res.get("sid"), "result": res})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/job_results.py

@@ -0,0 +1,84 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    sid = I["sid"]
+    params = {"output_mode": "json", "offset": int(I.get("offset") or 0),
+              "count": int(I.get("limit") or 100)}
+    res = req("GET", "/services/search/jobs/" + qq(sid) + "/results", params=params)
+    out({"results": res.get("results", [])})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/job_status.py

@@ -0,0 +1,89 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    sid = I["sid"]
+    res = req("GET", "/services/search/jobs/" + qq(sid), params={"output_mode": "json"})
+    content = {}
+    try:
+        content = res["entry"][0]["content"]
+    except Exception:
+        pass
+    out({"sid": sid, "dispatchState": content.get("dispatchState"),
+         "isDone": content.get("isDone"), "doneProgress": content.get("doneProgress"),
+         "resultCount": content.get("resultCount")})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/kv_store_collection_add_entries.py

@@ -0,0 +1,84 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    coll = I["kv_store_collection_name"]
+    entries = I.get("entries") or []
+    base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/data/" + qq(coll) + "/batch_save"
+    res = req("POST", base, params={"output_mode": "json"}, data=entries, ctype="json")
+    out({"keys": res})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/kv_store_collection_config.py

@@ -0,0 +1,87 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    coll = I["kv_store_collection_name"]
+    fields = I.get("fields") or {}
+    data = {}
+    for k, v in fields.items():
+        data["field." + k] = v
+    base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/config/" + qq(coll)
+    res = req("POST", base, params={"output_mode": "json"}, data=data)
+    out({"configured": coll, "fields": fields, "result": res})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/kv_store_collection_create.py

@@ -0,0 +1,83 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    name = I["kv_store_name"]
+    base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/config"
+    res = req("POST", base, params={"output_mode": "json"}, data={"name": name})
+    out({"created": name, "result": res})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/kv_store_collection_data_delete.py

@@ -0,0 +1,83 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    coll = I["kv_store_collection_name"]
+    base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/data/" + qq(coll)
+    req("DELETE", base, params={"output_mode": "json"})
+    out({"deleted_all": coll})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/kv_store_collection_data_list.py

@@ -0,0 +1,87 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    coll = I["kv_store_collection_name"]
+    params = {"output_mode": "json"}
+    lim = int(I.get("limit") or 0)
+    if lim:
+        params["limit"] = lim
+    base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/data/" + qq(coll)
+    res = req("GET", base, params=params)
+    out({"data": res})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/kv_store_collection_delete.py

@@ -0,0 +1,83 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    coll = I["kv_store_collection_name"]
+    base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/config/" + qq(coll)
+    req("DELETE", base, params={"output_mode": "json"})
+    out({"deleted": coll})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/kv_store_collection_delete_entry.py

@@ -0,0 +1,87 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    coll = I["kv_store_collection_name"]
+    query = I.get("query") or {}
+    if isinstance(query, str):
+        query = json.loads(query)
+    params = {"output_mode": "json", "query": json.dumps(query)}
+    base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/data/" + qq(coll)
+    req("DELETE", base, params=params)
+    out({"deleted": coll, "query": query})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/kv_store_collection_search_entry.py

@@ -0,0 +1,87 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    coll = I["kv_store_collection_name"]
+    query = I.get("query") or {}
+    if isinstance(query, str):
+        query = json.loads(query)
+    params = {"output_mode": "json", "query": json.dumps(query)}
+    base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/data/" + qq(coll)
+    res = req("GET", base, params=params)
+    out({"data": res})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/kv_store_collections_list.py

@@ -0,0 +1,82 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/config"
+    res = req("GET", base, params={"output_mode": "json", "count": "-1"})
+    out({"collections": [e.get("name") for e in res.get("entry", [])]})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/kv_store_update_entry.py

@@ -0,0 +1,89 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    coll = I["kv_store_collection_name"]
+    key = I["entry_key"]
+    field_name = I["field_name"]
+    new_value = I["new_value"]
+    base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/data/" + qq(coll) + "/" + qq(key)
+    current = req("GET", base, params={"output_mode": "json"})
+    if isinstance(current, dict):
+        current[field_name] = new_value
+    res = req("POST", base, params={"output_mode": "json"}, data=current, ctype="json")
+    out({"updated": key, "result": res})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/search.py

@@ -0,0 +1,91 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    q = (I.get("query") or "").strip()
+    if not (q.lower().startswith("search ") or q.startswith("|")):
+        q = "search " + q
+    data = {"search": q, "exec_mode": "oneshot", "output_mode": "json",
+            "count": int(I.get("limit") or 100)}
+    if I.get("earliest"):
+        data["earliest_time"] = I["earliest"]
+    if I.get("latest"):
+        data["latest_time"] = I["latest"]
+    path = "/servicesNS/nobody/" + qq(_app()) + "/search/jobs"
+    res = req("POST", path, data=data)
+    out({"results": res.get("results", [])})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/submit_event.py

@@ -0,0 +1,86 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    params = {"index": I["index"], "output_mode": "json"}
+    for k in ("sourcetype", "source", "host"):
+        if I.get(k):
+            params[k] = I[k]
+    res = req("POST", "/services/receivers/simple", params=params,
+              data=(I.get("event") or ""), ctype="text/plain")
+    out({"submitted": True, "result": res})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/submit_event_hec.py

@@ -0,0 +1,99 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    hec_url = (S.get("hec_url") or "").rstrip("/")
+    hec_token = S.get("hec_token") or ""
+    if not hec_url or not hec_token:
+        out({"error": "hec_url and hec_token must be configured on the instance"})
+        return
+    ev = I.get("event")
+    if isinstance(ev, str):
+        try:
+            ev = json.loads(ev)
+        except ValueError:
+            pass
+    payload = {"event": ev}
+    for k in ("index", "sourcetype", "source", "host"):
+        if I.get(k):
+            payload[k] = I[k]
+    if I.get("fields"):
+        payload["fields"] = I["fields"]
+    res = req("POST", "/services/collector/event", base=hec_url,
+              auth="Splunk " + hec_token, data=payload, ctype="json")
+    out(res)
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/test_connection.py

@@ -0,0 +1,85 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+def run():
+    info = req("GET", "/services/server/info", params={"output_mode": "json"})
+    version = ""
+    try:
+        version = info["entry"][0]["content"].get("version", "")
+    except Exception:
+        pass
+    out({"ok": True, "version": version})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)