Splunk Enterprise

Vendor key: splunk_enterprise. For how source fields and scan configs fit together, see Agent Discovery Integrations.

Runs your SPL query as a Splunk search job over the lookback window. Each row the query returns becomes one discovered agent. Your query decides what counts as an agent: gateway logs, proxy logs, EDR events, or anything else Splunk indexes.

Source fields

Field	Required	Sensitive	Default	Description
`base_url`	Yes	No		The Splunk management port URL, for example `https://splunk.example.com:8089`. Must be `https://`.
`auth_token`	Yes	Yes		A Splunk authentication token.
`ca_certificate`	No	No		A PEM CA certificate to trust in addition to the system CAs, for a server using a private CA.
`tls_verification`	No	No	`full`	`full` checks the certificate and hostname. `ca_only` checks only that a trusted CA issued the certificate; use it with `ca_certificate` for Splunk's default certificate, `SplunkServerDefaultCert`, which names no host. `off` disables verification and is not recommended.

Scan config

Setting	Value
`query`	Your SPL query. It must return the columns in the SIEM query output contract, named with `table` or `rename`. A leading `search` is added if you leave it out.
`query_language`	`spl`
`lookback_window_seconds`	Sent as the search's `earliest_time`. Don't also set a time range in the query. `0` searches all time.

Required permissions

The token's role must be able to run searches and must be allowed to search every index your query reads (srchIndexesAllowed). If a scan returns zero rows, check index access first.