Skip to main content

Splunk Connection

The following guide shows you how to manage Splunk connections in your Lumar account. Splunk connections allow Lumar to import log data for log file analysis reports.

Creating a Splunk connection​

Provide the Splunk API URL and credentials. Optionally configure a proxy.

mutation CreateSplunkConnection($input: CreateSplunkConnectionInput!) {
  createSplunkConnection(input: $input) {
    splunkConnection {
      id
      isWorking
      proxyCode
      customProxy
    }
  }
}

Try in explorer

Querying connections​

Retrieve all Splunk connections for an account:

query GetSplunkConnections {
  me {
    splunkConnections(first: 10) {
      nodes {
        id
        isWorking
        customProxy
        proxyCode
        createdAt
      }
      totalCount
    }
  }
}

Try in explorer

Updating a connection​

Update credentials, URL, or proxy settings:

mutation UpdateSplunkConnection($input: UpdateSplunkConnectionInput!) {
  updateSplunkConnection(input: $input) {
    splunkConnection {
      id
      isWorking
      proxyCode
      customProxy
    }
  }
}

Try in explorer

Proxy configuration​

If your Splunk instance is behind a firewall, you can configure a proxy:

  • Set proxyCode to Custom.
  • Set customProxy to your proxy URL (e.g., https://proxy.example.com:8080).

When no proxy is needed, leave both fields as null.

Deleting a connection​

Remove a Splunk connection:

mutation DeleteSplunkConnection($input: DeleteSplunkConnectionInput!) {
  deleteSplunkConnection(input: $input) {
    splunkConnection {
      id
    }
  }
}

Try in explorer

Project queries​

After creating a connection, set up project-level queries to define which Splunk data Lumar should fetch for a specific project:

mutation CreateSplunkProjectQuery($input: CreateSplunkProjectQueryInput!) {
  createSplunkProjectQuery(input: $input) {
    splunkProjectQuery {
      id
      query
      baseUrl
      dateRange
      enabled
      useLastCrawlDate
    }
  }
}

Try in explorer

You can also retrieve existing project queries:

query GetSplunkProjectQueries($projectId: ObjectID!) {
  getProject(id: $projectId) {
    splunkProjectQueries(first: 10) {
      nodes {
        id
        query
        baseUrl
        dateRange
        enabled
        useLastCrawlDate
        splunkConnection {
          id
          isWorking
        }
      }
      totalCount
    }
  }
}

Try in explorer

Key project query fields:

FieldDescription
queryThe Splunk search query string.
baseUrlThe base URL to match in log entries.
dateRangeNumber of days of log data to import.
useLastCrawlDateWhen true, uses the last crawl date as the start of the date range.
enabledWhether this query is active.