# Splunk Connection

https://api-docs.lumar.io/docs/graphql/splunk-connection

The following guide shows you how to manage Splunk connections in your Lumar account. Splunk connections allow Lumar to import log data for log file analysis reports.

## Creating a Splunk connection

Provide the Splunk API URL and credentials. Optionally configure a proxy.

```graphql
mutation CreateSplunkConnection($input: CreateSplunkConnectionInput!) {
  createSplunkConnection(input: $input) {
    splunkConnection {
      id
      isWorking
      proxyCode
      customProxy
    }
  }
}
```

**Variables:**
```json
{
  "input": {
    "url": "https://splunk.example.com:8089",
    "username": "splunk-api-user",
    "password": "your-splunk-password"
  }
}
```

**Response:**
```json
{
  "data": {
    "createSplunkConnection": {
      "splunkConnection": {
        "id": "TjAxOFNwbHVua0Nvbm5lY3Rpb24x",
        "isWorking": true,
        "proxyCode": null,
        "customProxy": null
      }
    }
  }
}
```

## Querying connections

Retrieve all Splunk connections for an account:

```graphql
query GetSplunkConnections {
  me {
    splunkConnections(first: 10) {
      nodes {
        id
        isWorking
        customProxy
        proxyCode
        createdAt
      }
      totalCount
    }
  }
}
```

**Variables:**
```json
{}
```

**Response:**
```json
{
  "data": {
    "me": {
      "splunkConnections": {
        "nodes": [
          {
            "id": "TjAxOFNwbHVua0Nvbm5lY3Rpb24x",
            "isWorking": true,
            "customProxy": null,
            "proxyCode": null,
            "createdAt": "2025-01-10T08:00:00.000Z"
          }
        ],
        "totalCount": 1
      }
    }
  }
}
```

## Updating a connection

Update credentials, URL, or proxy settings:

```graphql
mutation UpdateSplunkConnection($input: UpdateSplunkConnectionInput!) {
  updateSplunkConnection(input: $input) {
    splunkConnection {
      id
      isWorking
      proxyCode
      customProxy
    }
  }
}
```

**Variables:**
```json
{
  "input": {
    "splunkConnectionId": "TjAxOFNwbHVua0Nvbm5lY3Rpb24x",
    "proxyCode": "Custom",
    "customProxy": "https://proxy.example.com:8080"
  }
}
```

**Response:**
```json
{
  "data": {
    "updateSplunkConnection": {
      "splunkConnection": {
        "id": "TjAxOFNwbHVua0Nvbm5lY3Rpb24x",
        "isWorking": true,
        "proxyCode": "Custom",
        "customProxy": "https://proxy.example.com:8080"
      }
    }
  }
}
```

## Proxy configuration

If your Splunk instance is behind a firewall, you can configure a proxy:

- Set `proxyCode` to `Custom`.
- Set `customProxy` to your proxy URL (e.g., `https://proxy.example.com:8080`).

When no proxy is needed, leave both fields as `null`.

## Deleting a connection

Remove a Splunk connection:

```graphql
mutation DeleteSplunkConnection($input: DeleteSplunkConnectionInput!) {
  deleteSplunkConnection(input: $input) {
    splunkConnection {
      id
    }
  }
}
```

**Variables:**
```json
{
  "input": {
    "splunkConnectionId": "TjAxOFNwbHVua0Nvbm5lY3Rpb24x"
  }
}
```

**Response:**
```json
{
  "data": {
    "deleteSplunkConnection": {
      "splunkConnection": {
        "id": "TjAxOFNwbHVua0Nvbm5lY3Rpb24x"
      }
    }
  }
}
```

## Project queries

After creating a connection, set up project-level queries to define which Splunk data Lumar should fetch for a specific project:

```graphql
mutation CreateSplunkProjectQuery($input: CreateSplunkProjectQueryInput!) {
  createSplunkProjectQuery(input: $input) {
    splunkProjectQuery {
      id
      query
      baseUrl
      dateRange
      enabled
      useLastCrawlDate
    }
  }
}
```

**Variables:**
```json
{
  "input": {
    "splunkConnectionId": "TjAxOFNwbHVua0Nvbm5lY3Rpb24x",
    "projectId": "TjAwN1Byb2plY3Q2MTMy",
    "query": "index=web sourcetype=access_combined",
    "baseUrl": "https://www.example.com",
    "dateRange": 30,
    "enabled": true,
    "useLastCrawlDate": false
  }
}
```

**Response:**
```json
{
  "data": {
    "createSplunkProjectQuery": {
      "splunkProjectQuery": {
        "id": "TjAxOFNwbHVua1Byb2plY3RRdWVyeTEy",
        "query": "index=web sourcetype=access_combined",
        "baseUrl": "https://www.example.com",
        "dateRange": 30,
        "enabled": true,
        "useLastCrawlDate": false
      }
    }
  }
}
```

You can also retrieve existing project queries:

```graphql
query GetSplunkProjectQueries($projectId: ObjectID!) {
  getProject(id: $projectId) {
    splunkProjectQueries(first: 10) {
      nodes {
        id
        query
        baseUrl
        dateRange
        enabled
        useLastCrawlDate
        splunkConnection {
          id
          isWorking
        }
      }
      totalCount
    }
  }
}
```

**Variables:**
```json
{
  "projectId": "TjAwN1Byb2plY3Q2MTMy"
}
```

**Response:**
```json
{
  "data": {
    "getProject": {
      "splunkProjectQueries": {
        "nodes": [
          {
            "id": "TjAxOFNwbHVua1Byb2plY3RRdWVyeTEy",
            "query": "index=web sourcetype=access_combined",
            "baseUrl": "https://www.example.com",
            "dateRange": 30,
            "enabled": true,
            "useLastCrawlDate": false,
            "splunkConnection": {
              "id": "TjAxOFNwbHVua0Nvbm5lY3Rpb24x",
              "isWorking": true
            }
          }
        ],
        "totalCount": 1
      }
    }
  }
}
```

Key project query fields:

| Field              | Description                                                           |
| ------------------ | --------------------------------------------------------------------- |
| `query`            | The Splunk search query string.                                       |
| `baseUrl`          | The base URL to match in log entries.                                 |
| `dateRange`        | Number of days of log data to import.                                 |
| `useLastCrawlDate` | When `true`, uses the last crawl date as the start of the date range. |
| `enabled`          | Whether this query is active.                                         |