feat(splunk): full Splunk REST integration (search, jobs, KV Store, events)

20 commands over the management port (8089) with token or basic auth:
SPL search (oneshot) as an ingestion source with an OCSF mapper for
notable/CIM findings; async search jobs (create/status/results); index
listing; event submission (receivers/simple + HEC); the complete KV Store
command set (collection create/config/delete, list, data list/add/delete,
entry search/delete/update); user list/delete; and a connectivity test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

integrations/splunk/manifest.yaml

@@ -0,0 +1,279 @@
+id: splunk
+name: Splunk
+version: 1.1.0
+description: "Splunk (REST API, management port 8089) — run SPL searches with notable/CIM finding ingestion and an OCSF mapper, manage search jobs, indexes and event submission (incl. HEC), full KV Store collection/entry management, and user administration. Token or basic authentication."
+changelog: "1.1.0 — Full coverage: search jobs (create/status/results), indexes listing, event submission (receivers/simple + HEC), and the complete KV Store command set (collection create/config/delete, list, data list/add/delete, entry search/delete/update). 1.0.0 — Initial release: SPL search (oneshot) ingestion with a bundled OCSF mapper for notable/CIM events, get_users, delete_user and a KV Store entry update."
+category: siem
+
+# Per-instance configuration. The REST API lives on the Splunk management port (default 8089),
+# NOT the web port. Token auth uses an authentication token (Settings → Tokens); basic auth
+# uses a username + password. HEC fields are only needed for splunk-submit-event-hec.
+config_schema:
+  properties:
+    host:
+      type: string
+      description: "Splunk server host or URL (e.g. splunk.example.com or https://splunk.example.com)"
+    port:
+      type: string
+      description: "REST management port (default 8089)"
+      default: "8089"
+    auth_type:
+      type: string
+      description: "Authentication method: token (Bearer authentication token) or basic (username + password)"
+      default: token
+    username:
+      type: string
+      description: "Username (basic auth only)"
+    password:
+      type: string
+      description: "Authentication token (token auth) or password (basic auth)"
+      x-soar-sensitive: true
+    app:
+      type: string
+      description: "Default app namespace for KV Store operations (default 'search')"
+      default: search
+    hec_url:
+      type: string
+      description: "HTTP Event Collector base URL for splunk-submit-event-hec (e.g. https://splunk.example.com:8088)"
+    hec_token:
+      type: string
+      description: "HTTP Event Collector token for splunk-submit-event-hec"
+      x-soar-sensitive: true
+    verify:
+      type: boolean
+      description: "Verify the server TLS certificate (default false; Splunk often uses self-signed certs)"
+      default: false
+  required:
+    - host
+    - password
+
+# Documented for reference; the bundled scripts build the Authorization header themselves.
+# token: Authorization: Bearer <token>   basic: Authorization: Basic base64(user:pass)
+auth:
+  - id: apikey
+    type: api_key
+    in: header
+    name: Authorization
+    value_template: "Bearer {{secret}}"
+    secret_field: password
+
+commands:
+  # ── Ingestion / search ────────────────────────────────────────────────────
+  - id: search
+    name: splunk-search
+    description: "Run an SPL search (oneshot) and return the result rows. Use as an ingestion source by searching for notable events; results are under the 'results' array."
+    risk: read
+    inputs_schema:
+      properties:
+        query: { type: string, description: "SPL query (a leading 'search ' is added automatically if missing)" }
+        earliest: { type: string, description: "Earliest time (e.g. -24h, -7d@d, or an epoch); incremental fetch watermark" }
+        latest: { type: string, description: "Latest time (e.g. now)" }
+        limit: { type: number, description: "Maximum result rows (default 100)" }
+        app: { type: string, description: "App namespace to run the search in (defaults to the instance 'app' config)" }
+      required: [query]
+    outputs_schema: { properties: {} }
+    ingest:
+      results_path: results
+      dedup_key: event_id
+      incremental_field: earliest
+
+  # ── Search jobs ───────────────────────────────────────────────────────────
+  - id: job_create
+    name: splunk-job-create
+    description: "Dispatch an asynchronous search job and return its sid. Poll with splunk-job-status, then fetch with splunk-job-results."
+    risk: read
+    inputs_schema:
+      properties:
+        query: { type: string, description: "SPL query (a leading 'search ' is added automatically if missing)" }
+        earliest: { type: string, description: "Earliest time (e.g. -24h)" }
+        latest: { type: string, description: "Latest time (e.g. now)" }
+        app: { type: string, description: "App namespace (defaults to the instance 'app' config)" }
+      required: [query]
+    outputs_schema: { properties: {} }
+  - id: job_status
+    name: splunk-job-status
+    description: "Return the status (dispatchState, doneProgress, resultCount) of a search job by sid."
+    risk: read
+    inputs_schema:
+      properties:
+        sid: { type: string, description: "Search job id" }
+      required: [sid]
+    outputs_schema: { properties: {} }
+  - id: job_results
+    name: splunk-job-results
+    description: "Fetch the results of a completed search job by sid."
+    risk: read
+    inputs_schema:
+      properties:
+        sid: { type: string, description: "Search job id" }
+        offset: { type: number, description: "Result offset (default 0)" }
+        limit: { type: number, description: "Maximum result rows (default 100; 0 = all)" }
+      required: [sid]
+    outputs_schema: { properties: {} }
+
+  # ── Indexes & event submission ────────────────────────────────────────────
+  - id: get_indexes
+    name: splunk-get-indexes
+    description: "List the indexes configured on the Splunk instance with their event counts and sizes."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }
+  - id: submit_event
+    name: splunk-submit-event
+    description: "Submit a single event to an index via the REST receivers/simple endpoint."
+    inputs_schema:
+      properties:
+        index: { type: string, description: "Target index name" }
+        event: { type: string, description: "Event payload (raw string)" }
+        sourcetype: { type: string, description: "Sourcetype to assign (optional)" }
+        source: { type: string, description: "Source to assign (optional)" }
+        host: { type: string, description: "Host to assign (optional)" }
+      required: [index, event]
+    outputs_schema: { properties: {} }
+  - id: submit_event_hec
+    name: splunk-submit-event-hec
+    description: "Submit an event through the HTTP Event Collector (HEC). Requires hec_url and hec_token in the instance config."
+    inputs_schema:
+      properties:
+        event: { type: string, description: "Event payload (string or JSON object as a string)" }
+        index: { type: string, description: "Target index (optional)" }
+        sourcetype: { type: string, description: "Sourcetype (optional)" }
+        source: { type: string, description: "Source (optional)" }
+        host: { type: string, description: "Host (optional)" }
+        fields: { type: object, description: "Indexed fields object (optional)" }
+      required: [event]
+    outputs_schema: { properties: {} }
+
+  # ── User management ───────────────────────────────────────────────────────
+  - id: get_users
+    name: splunk-get-users
+    description: "List Splunk users with their roles and metadata."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }
+  - id: delete_user
+    name: splunk-delete-user
+    description: "Delete a Splunk user by username."
+    inputs_schema:
+      properties:
+        username: { type: string, description: "Username to delete" }
+      required: [username]
+    outputs_schema: { properties: {} }
+
+  # ── KV Store: collections ─────────────────────────────────────────────────
+  - id: kv_store_collections_list
+    name: splunk-kv-store-collections-list
+    description: "List the KV Store collections defined in an app."
+    risk: read
+    inputs_schema:
+      properties:
+        app_name: { type: string, description: "App namespace (defaults to the instance 'app' config)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: kv_store_collection_create
+    name: splunk-kv-store-collection-create
+    description: "Create a new KV Store collection in an app."
+    inputs_schema:
+      properties:
+        app_name: { type: string, description: "App namespace (defaults to the instance 'app' config)" }
+        kv_store_name: { type: string, description: "Name of the collection to create" }
+      required: [kv_store_name]
+    outputs_schema: { properties: {} }
+  - id: kv_store_collection_config
+    name: splunk-kv-store-collection-config
+    description: "Define field types on a KV Store collection (e.g. field.name=string). Pass a JSON object mapping field name to type."
+    inputs_schema:
+      properties:
+        app_name: { type: string, description: "App namespace (defaults to the instance 'app' config)" }
+        kv_store_collection_name: { type: string, description: "Collection name" }
+        fields: { type: object, description: "Object mapping field name to type (string|number|bool|time|cidr)" }
+      required: [kv_store_collection_name, fields]
+    outputs_schema: { properties: {} }
+  - id: kv_store_collection_delete
+    name: splunk-kv-store-collection-delete
+    description: "Delete a KV Store collection and all of its data."
+    inputs_schema:
+      properties:
+        app_name: { type: string, description: "App namespace (defaults to the instance 'app' config)" }
+        kv_store_collection_name: { type: string, description: "Collection name to delete" }
+      required: [kv_store_collection_name]
+    outputs_schema: { properties: {} }
+
+  # ── KV Store: data ────────────────────────────────────────────────────────
+  - id: kv_store_collection_add_entries
+    name: splunk-kv-store-collection-add-entries
+    description: "Insert one or more entries into a KV Store collection (batch_save). Pass a JSON array of objects."
+    inputs_schema:
+      properties:
+        app_name: { type: string, description: "App namespace (defaults to the instance 'app' config)" }
+        kv_store_collection_name: { type: string, description: "Collection name" }
+        entries: { type: array, description: "Array of entry objects to insert" }
+      required: [kv_store_collection_name, entries]
+    outputs_schema: { properties: {} }
+  - id: kv_store_collection_data_list
+    name: splunk-kv-store-collection-data-list
+    description: "List all entries in a KV Store collection."
+    risk: read
+    inputs_schema:
+      properties:
+        app_name: { type: string, description: "App namespace (defaults to the instance 'app' config)" }
+        kv_store_collection_name: { type: string, description: "Collection name" }
+        limit: { type: number, description: "Maximum entries (default 0 = all)" }
+      required: [kv_store_collection_name]
+    outputs_schema: { properties: {} }
+  - id: kv_store_collection_data_delete
+    name: splunk-kv-store-collection-data-delete
+    description: "Delete ALL entries in a KV Store collection (the collection itself is kept)."
+    inputs_schema:
+      properties:
+        app_name: { type: string, description: "App namespace (defaults to the instance 'app' config)" }
+        kv_store_collection_name: { type: string, description: "Collection name" }
+      required: [kv_store_collection_name]
+    outputs_schema: { properties: {} }
+  - id: kv_store_collection_search_entry
+    name: splunk-kv-store-collection-search-entry
+    description: "Search entries in a KV Store collection with a Mongo-style query (JSON object)."
+    risk: read
+    inputs_schema:
+      properties:
+        app_name: { type: string, description: "App namespace (defaults to the instance 'app' config)" }
+        kv_store_collection_name: { type: string, description: "Collection name" }
+        query: { type: object, description: "Mongo-style query object, e.g. {\"name\": \"foo\"}" }
+      required: [kv_store_collection_name, query]
+    outputs_schema: { properties: {} }
+  - id: kv_store_collection_delete_entry
+    name: splunk-kv-store-collection-delete-entry
+    description: "Delete entries in a KV Store collection matching a Mongo-style query (JSON object)."
+    inputs_schema:
+      properties:
+        app_name: { type: string, description: "App namespace (defaults to the instance 'app' config)" }
+        kv_store_collection_name: { type: string, description: "Collection name" }
+        query: { type: object, description: "Mongo-style query object selecting entries to delete" }
+      required: [kv_store_collection_name, query]
+    outputs_schema: { properties: {} }
+  - id: kv_store_update_entry
+    name: splunk-kv-store-update-entry
+    description: "Update a single field of an existing KV Store entry by key, preserving the other fields."
+    inputs_schema:
+      properties:
+        app_name: { type: string, description: "App namespace (defaults to the instance 'app' config)" }
+        kv_store_collection_name: { type: string, description: "KV Store collection name" }
+        entry_key: { type: string, description: "The _key of the entry to update" }
+        field_name: { type: string, description: "Field to update" }
+        new_value: { type: string, description: "New value for the field" }
+      required: [kv_store_collection_name, entry_key, field_name, new_value]
+    outputs_schema: { properties: {} }
+
+  # ── Connectivity ──────────────────────────────────────────────────────────
+  - id: test_connection
+    name: splunk-test-connection
+    description: "Verify connectivity and credentials against the Splunk REST API (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }

integrations/splunk/mappers/search.yaml

@@ -0,0 +1,35 @@
+name: "Splunk Notable / CIM → OCSF"
+description: "Maps a Splunk notable / CIM finding row (search results_path = results) to OCSF Finding fields. Built for ES notable events surfaced by the `notable` macro (rule_title/rule_name/urgency/security_domain) enriched with CIM Network/Authentication fields (src/dest/user/dvc). Severity is normalised to the OCSF 1-5 scale from the notable `urgency`."
+field_mappings:
+  title: "rule_title ? rule_title : (source ? source : event_id)"
+  # urgency: informational/low -> low, up to critical=5 (OCSF 1-5 scale).
+  severity: "urgency = 'critical' ? 5 : (urgency = 'high' ? 4 : (urgency = 'medium' ? 3 : (urgency = 'low' ? 2 : 1)))"
+  description: "rule_description"
+# results_path = results; source_path is JSONata over ONE result row.
+# Fields absent from a given row are skipped at ingestion, so extra entries are safe.
+ocsf:
+  # ── Finding ───────────────────────────────────────────────────────
+  - { source_path: "event_id",         ocsf_field: "finding_info.uid" }
+  - { source_path: "rule_title",       ocsf_field: "finding_info.title" }
+  - { source_path: "rule_description", ocsf_field: "finding_info.desc" }
+  - { source_path: "`_time`",          ocsf_field: "finding_info.created_time" }
+  - { source_path: "security_domain",  ocsf_field: "finding_info.analytic.category" }
+  - { source_path: "status_label",     ocsf_field: "status" }
+  # ── Rule (correlation search) / provenance ────────────────────────
+  - { source_path: "rule_name",        ocsf_field: "rule.name" }
+  - { source_path: "rule_description", ocsf_field: "rule.desc" }
+  - { source_path: "signature",        ocsf_field: "metadata.event_code" }
+  - { source_path: "source",           ocsf_field: "metadata.log_name" }
+  - { source_path: "sourcetype",       ocsf_field: "metadata.log_source" }
+  # ── Source endpoint (CIM Network) ─────────────────────────────────
+  - { source_path: "src",              ocsf_field: "src_endpoint.hostname" }
+  - { source_path: "src_ip",           ocsf_field: "src_endpoint.ip" }
+  - { source_path: "src_port",         ocsf_field: "src_endpoint.port" }
+  # ── Destination endpoint (CIM Network) ────────────────────────────
+  - { source_path: "dest",             ocsf_field: "dst_endpoint.hostname" }
+  - { source_path: "dest_ip",          ocsf_field: "dst_endpoint.ip" }
+  - { source_path: "dest_port",        ocsf_field: "dst_endpoint.port" }
+  # ── Affected device / users (CIM) ─────────────────────────────────
+  - { source_path: "dvc",              ocsf_field: "device.hostname" }
+  - { source_path: "user",             ocsf_field: "user.name" }
+  - { source_path: "src_user",         ocsf_field: "actor.user.name" }

integrations/splunk/scripts/delete_user.py

@@ -0,0 +1,83 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    user = I["username"]
+    res = req("DELETE", "/services/authentication/users/" + qq(user),
+              params={"output_mode": "json"})
+    out({"deleted": user, "result": res})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/get_indexes.py

@@ -0,0 +1,86 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    res = req("GET", "/services/data/indexes", params={"output_mode": "json", "count": "-1"})
+    indexes = []
+    for e in res.get("entry", []):
+        c = e.get("content", {})
+        indexes.append({"name": e.get("name"), "totalEventCount": c.get("totalEventCount"),
+                        "currentDBSizeMB": c.get("currentDBSizeMB"), "disabled": c.get("disabled")})
+    out({"indexes": indexes})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/get_users.py

@@ -0,0 +1,87 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    res = req("GET", "/services/authentication/users", params={"output_mode": "json", "count": "-1"})
+    users = []
+    for e in res.get("entry", []):
+        c = e.get("content", {})
+        users.append({"name": e.get("name"), "realname": c.get("realname"),
+                      "email": c.get("email"), "roles": c.get("roles"),
+                      "type": c.get("type"), "locked-out": c.get("locked-out")})
+    out({"users": users})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/job_create.py

@@ -0,0 +1,90 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    q = (I.get("query") or "").strip()
+    if not (q.lower().startswith("search ") or q.startswith("|")):
+        q = "search " + q
+    data = {"search": q, "output_mode": "json"}
+    if I.get("earliest"):
+        data["earliest_time"] = I["earliest"]
+    if I.get("latest"):
+        data["latest_time"] = I["latest"]
+    path = "/servicesNS/nobody/" + qq(_app()) + "/search/jobs"
+    res = req("POST", path, data=data)
+    out({"sid": res.get("sid"), "result": res})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/job_results.py

@@ -0,0 +1,84 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    sid = I["sid"]
+    params = {"output_mode": "json", "offset": int(I.get("offset") or 0),
+              "count": int(I.get("limit") or 100)}
+    res = req("GET", "/services/search/jobs/" + qq(sid) + "/results", params=params)
+    out({"results": res.get("results", [])})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/job_status.py

@@ -0,0 +1,89 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    sid = I["sid"]
+    res = req("GET", "/services/search/jobs/" + qq(sid), params={"output_mode": "json"})
+    content = {}
+    try:
+        content = res["entry"][0]["content"]
+    except Exception:
+        pass
+    out({"sid": sid, "dispatchState": content.get("dispatchState"),
+         "isDone": content.get("isDone"), "doneProgress": content.get("doneProgress"),
+         "resultCount": content.get("resultCount")})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/kv_store_collection_add_entries.py

@@ -0,0 +1,84 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    coll = I["kv_store_collection_name"]
+    entries = I.get("entries") or []
+    base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/data/" + qq(coll) + "/batch_save"
+    res = req("POST", base, params={"output_mode": "json"}, data=entries, ctype="json")
+    out({"keys": res})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/kv_store_collection_config.py

@@ -0,0 +1,87 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    coll = I["kv_store_collection_name"]
+    fields = I.get("fields") or {}
+    data = {}
+    for k, v in fields.items():
+        data["field." + k] = v
+    base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/config/" + qq(coll)
+    res = req("POST", base, params={"output_mode": "json"}, data=data)
+    out({"configured": coll, "fields": fields, "result": res})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/kv_store_collection_create.py

@@ -0,0 +1,83 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    name = I["kv_store_name"]
+    base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/config"
+    res = req("POST", base, params={"output_mode": "json"}, data={"name": name})
+    out({"created": name, "result": res})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/kv_store_collection_data_delete.py

@@ -0,0 +1,83 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    coll = I["kv_store_collection_name"]
+    base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/data/" + qq(coll)
+    req("DELETE", base, params={"output_mode": "json"})
+    out({"deleted_all": coll})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/kv_store_collection_data_list.py

@@ -0,0 +1,87 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    coll = I["kv_store_collection_name"]
+    params = {"output_mode": "json"}
+    lim = int(I.get("limit") or 0)
+    if lim:
+        params["limit"] = lim
+    base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/data/" + qq(coll)
+    res = req("GET", base, params=params)
+    out({"data": res})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/kv_store_collection_delete.py

@@ -0,0 +1,83 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    coll = I["kv_store_collection_name"]
+    base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/config/" + qq(coll)
+    req("DELETE", base, params={"output_mode": "json"})
+    out({"deleted": coll})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/kv_store_collection_delete_entry.py

@@ -0,0 +1,87 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    coll = I["kv_store_collection_name"]
+    query = I.get("query") or {}
+    if isinstance(query, str):
+        query = json.loads(query)
+    params = {"output_mode": "json", "query": json.dumps(query)}
+    base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/data/" + qq(coll)
+    req("DELETE", base, params=params)
+    out({"deleted": coll, "query": query})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/kv_store_collection_search_entry.py

@@ -0,0 +1,87 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    coll = I["kv_store_collection_name"]
+    query = I.get("query") or {}
+    if isinstance(query, str):
+        query = json.loads(query)
+    params = {"output_mode": "json", "query": json.dumps(query)}
+    base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/data/" + qq(coll)
+    res = req("GET", base, params=params)
+    out({"data": res})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/kv_store_collections_list.py

@@ -0,0 +1,82 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/config"
+    res = req("GET", base, params={"output_mode": "json", "count": "-1"})
+    out({"collections": [e.get("name") for e in res.get("entry", [])]})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/kv_store_update_entry.py

@@ -0,0 +1,89 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    coll = I["kv_store_collection_name"]
+    key = I["entry_key"]
+    field_name = I["field_name"]
+    new_value = I["new_value"]
+    base = "/servicesNS/nobody/" + qq(_app()) + "/storage/collections/data/" + qq(coll) + "/" + qq(key)
+    current = req("GET", base, params={"output_mode": "json"})
+    if isinstance(current, dict):
+        current[field_name] = new_value
+    res = req("POST", base, params={"output_mode": "json"}, data=current, ctype="json")
+    out({"updated": key, "result": res})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/search.py

@@ -0,0 +1,91 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    q = (I.get("query") or "").strip()
+    if not (q.lower().startswith("search ") or q.startswith("|")):
+        q = "search " + q
+    data = {"search": q, "exec_mode": "oneshot", "output_mode": "json",
+            "count": int(I.get("limit") or 100)}
+    if I.get("earliest"):
+        data["earliest_time"] = I["earliest"]
+    if I.get("latest"):
+        data["latest_time"] = I["latest"]
+    path = "/servicesNS/nobody/" + qq(_app()) + "/search/jobs"
+    res = req("POST", path, data=data)
+    out({"results": res.get("results", [])})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/submit_event.py

@@ -0,0 +1,86 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    params = {"index": I["index"], "output_mode": "json"}
+    for k in ("sourcetype", "source", "host"):
+        if I.get(k):
+            params[k] = I[k]
+    res = req("POST", "/services/receivers/simple", params=params,
+              data=(I.get("event") or ""), ctype="text/plain")
+    out({"submitted": True, "result": res})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/submit_event_hec.py

@@ -0,0 +1,99 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+
+def run():
+    hec_url = (S.get("hec_url") or "").rstrip("/")
+    hec_token = S.get("hec_token") or ""
+    if not hec_url or not hec_token:
+        out({"error": "hec_url and hec_token must be configured on the instance"})
+        return
+    ev = I.get("event")
+    if isinstance(ev, str):
+        try:
+            ev = json.loads(ev)
+        except ValueError:
+            pass
+    payload = {"event": ev}
+    for k in ("index", "sourcetype", "source", "host"):
+        if I.get(k):
+            payload[k] = I[k]
+    if I.get("fields"):
+        payload["fields"] = I["fields"]
+    res = req("POST", "/services/collector/event", base=hec_url,
+              auth="Splunk " + hec_token, data=payload, ctype="json")
+    out(res)
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)

integrations/splunk/scripts/test_connection.py

@@ -0,0 +1,85 @@
+import json, os, ssl, sys, base64, urllib.parse, urllib.request, urllib.error
+
+S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def qq(v):
+    return urllib.parse.quote(str(v), safe="")
+
+
+def _base():
+    host = (S.get("host") or "").strip()
+    if "://" in host:
+        host = host.split("://", 1)[1]
+    host = host.strip("/")
+    if ":" not in host:
+        host = host + ":" + str(S.get("port") or "8089").strip()
+    return "https://" + host
+
+
+def _auth():
+    if str(S.get("auth_type") or "token").lower() == "basic":
+        raw = (S.get("username") or "") + ":" + (S.get("password") or "")
+        return "Basic " + base64.b64encode(raw.encode("utf-8")).decode("ascii")
+    return "Bearer " + (S.get("password") or "")
+
+
+def _ctx():
+    v = S.get("verify")
+    if isinstance(v, str):
+        v = v.lower() in ("1", "true", "yes")
+    return ssl.create_default_context() if v else ssl._create_unverified_context()
+
+
+def _app(default="search"):
+    return I.get("app") or I.get("app_name") or S.get("app") or default
+
+
+def req(method, path, params=None, data=None, base=None, auth=None, ctype=None):
+    url = (base or _base()) + path
+    if params:
+        url += "?" + urllib.parse.urlencode(params, doseq=True)
+    headers = {"Authorization": auth or _auth(), "Accept": "application/json"}
+    body = None
+    if data is not None:
+        if ctype == "json":
+            body = json.dumps(data).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        elif isinstance(data, dict):
+            body = urllib.parse.urlencode(data, doseq=True).encode("utf-8")
+            headers["Content-Type"] = "application/x-www-form-urlencoded"
+        else:
+            body = data.encode("utf-8") if isinstance(data, str) else data
+            headers["Content-Type"] = ctype or "text/plain"
+    request = urllib.request.Request(url, data=body, headers=headers, method=method)
+    with urllib.request.urlopen(request, timeout=120, context=_ctx()) as resp:
+        raw = resp.read()
+        try:
+            return json.loads(raw) if raw else {}
+        except ValueError:
+            return {"raw": raw.decode("utf-8", "replace")}
+
+
+def out(value):
+    print(json.dumps(value))
+
+
+def run():
+    info = req("GET", "/services/server/info", params={"output_mode": "json"})
+    version = ""
+    try:
+        version = info["entry"][0]["content"].get("version", "")
+    except Exception:
+        pass
+    out({"ok": True, "version": version})
+
+
+try:
+    run()
+except urllib.error.HTTPError as e:
+    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+    sys.exit(1)
+except Exception as e:
+    print(json.dumps({"error": str(e)}))
+    sys.exit(1)