---
title: "Splunk"
description: "Reference for the Tracecat Splunk integration: registered actions, required secrets, expected inputs, and example workflow usage."
---

{/* Auto-generated by scripts/generate_tool_docs.py; do not edit by hand. */}
## Add fields to collection

Action ID: `tools.splunk.add_kv_fields`

Add field definitions to a KV Store collection in Splunk.

Reference: [https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#post-9](https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#post-9)

### Secrets

Required secrets:

- `splunk`: required values `SPLUNK_API_KEY`.

### Input fields

<ParamField path="collection" type="string" required>

Name of the KV Store collection to add fields to. Must be unique and
contain only alphanumeric characters, underscores, and hyphens.

</ParamField>

<ParamField path="fields" type="array[map[string, string]]" required>

List of field definitions to add. Each field requires name and type.
Supported types: array, number, bool, string, cidr, time
Example: [&#123;"name": "username", "type": "string"&#125;, &#123;"name": "age", "type": "number"&#125;]

</ParamField>

<ParamField path="app" type="string">

Splunk app context where the collection resides (e.g. "search" for default).

Default: `"search"`.

</ParamField>

<ParamField path="base_url" type="string | null">

Splunk base URL (e.g. https://localhost:8089 or https://tracecat.splunkcloud.com:8089).

Default: `null`.

</ParamField>

<ParamField path="owner" type="string">

Splunk namespace owner for access control (use "nobody" for shared access).

Default: `"nobody"`.

</ParamField>

<ParamField path="verify_ssl" type="boolean">

Whether to verify SSL certificates.

Default: `true`.

</ParamField>

## Batch save KV entries

Action ID: `tools.splunk.batch_save_kv_entries`

Insert or update multiple entries in a Splunk KV Store collection in a single request. If an entry includes a _key that matches an existing document, it is updated; otherwise a new document is created. Processing stops on the first failure.

Reference: [https://help.splunk.com/en/splunk-cloud-platform/leverage-rest-apis/rest-api-reference/10.0.2503/kv-store-endpoints/kv-store-endpoint-descriptions#ariaid-title16](https://help.splunk.com/en/splunk-cloud-platform/leverage-rest-apis/rest-api-reference/10.0.2503/kv-store-endpoints/kv-store-endpoint-descriptions#ariaid-title16)

### Secrets

Required secrets:

- `splunk`: required values `SPLUNK_API_KEY`.

### Input fields

<ParamField path="collection" type="string" required>

Name of the KV Store collection to save entries into.

</ParamField>

<ParamField path="entries" type="array[object]" required>

List of documents to save. Each document is a dict of field-value pairs.
Include a _key field to update an existing document; omit it to create a new one
(Splunk auto-generates the key). Maximum 1000 documents per request (Splunk default).
Example: [&#123;"username": "john", "email": "john@example.com", "active": true&#125;, &#123;"username": "jane", "email": "jane@example.com", "active": false&#125;]

</ParamField>

<ParamField path="app" type="string">

Splunk app context where the collection resides (e.g. "search" for default).

Default: `"search"`.

</ParamField>

<ParamField path="base_url" type="string | null">

Splunk base URL (e.g. https://localhost:8089 or https://tracecat.splunkcloud.com:8089).

Default: `null`.

</ParamField>

<ParamField path="owner" type="string">

Splunk namespace owner for access control (use "nobody" for shared access).

Default: `"nobody"`.

</ParamField>

<ParamField path="verify_ssl" type="boolean">

Whether to verify SSL certificates.

Default: `true`.

</ParamField>

## Create KV collection

Action ID: `tools.splunk.create_kv_collection`

Create a new KV Store collection in Splunk.

Reference: [https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#post-9](https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#post-9)

### Secrets

Required secrets:

- `splunk`: required values `SPLUNK_API_KEY`.

### Input fields

<ParamField path="name" type="string" required>

Name of the KV Store collection. Must be unique and contain only
alphanumeric characters, underscores, and hyphens.

</ParamField>

<ParamField path="app" type="string">

Splunk app context where the collection will be created (e.g. "search" for default).

Default: `"search"`.

</ParamField>

<ParamField path="base_url" type="string | null">

Splunk base URL (e.g. https://localhost:8089 or https://tracecat.splunkcloud.com:8089).

Default: `null`.

</ParamField>

<ParamField path="owner" type="string">

Splunk namespace owner for access control (use "nobody" for shared access).

Default: `"nobody"`.

</ParamField>

<ParamField path="verify_ssl" type="boolean">

Whether to verify SSL certificates.

Default: `true`.

</ParamField>

## Create KV entry

Action ID: `tools.splunk.create_kv_entry`

Create a new entry in a Splunk KV Store collection.

Reference: [https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#post-2](https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#post-2)

### Secrets

Required secrets:

- `splunk`: required values `SPLUNK_API_KEY`.

### Input fields

<ParamField path="collection" type="string" required>

Name of the KV Store collection where the entry will be created.

</ParamField>

<ParamField path="entry" type="object" required>

Key-value pairs to store in the collection. The _key field is automatically
generated by Splunk if not provided.
Example: &#123;"username": "john", "email": "john@example.com", "active": true&#125;

</ParamField>

<ParamField path="app" type="string">

Splunk app context where the collection resides (e.g. "search" for default).

Default: `"search"`.

</ParamField>

<ParamField path="base_url" type="string | null">

Splunk base URL (e.g. https://localhost:8089 or https://tracecat.splunkcloud.com:8089).

Default: `null`.

</ParamField>

<ParamField path="owner" type="string">

Splunk namespace owner for access control (use "nobody" for shared access).

Default: `"nobody"`.

</ParamField>

<ParamField path="verify_ssl" type="boolean">

Whether to verify SSL certificates.

Default: `true`.

</ParamField>

## Delete KV collection

Action ID: `tools.splunk.delete_kv_collection`

Delete a KV Store collection from Splunk.

Reference: [https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#delete-0](https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#delete-0)

### Secrets

Required secrets:

- `splunk`: required values `SPLUNK_API_KEY`.

### Input fields

<ParamField path="collection" type="string" required>

Name of the KV Store collection to delete.

</ParamField>

<ParamField path="app" type="string">

Splunk app context where the collection resides (e.g. "search" for default).

Default: `"search"`.

</ParamField>

<ParamField path="base_url" type="string | null">

Splunk base URL (e.g. https://localhost:8089 or https://tracecat.splunkcloud.com:8089).

Default: `null`.

</ParamField>

<ParamField path="owner" type="string">

Splunk namespace owner for access control (use "nobody" for shared access).

Default: `"nobody"`.

</ParamField>

<ParamField path="verify_ssl" type="boolean">

Whether to verify SSL certificates.

Default: `true`.

</ParamField>

## Delete KV entry

Action ID: `tools.splunk.delete_kv_entry`

Delete an entry from a KV Store collection in Splunk.

Reference: [https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#delete-1](https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#delete-1)

### Secrets

Required secrets:

- `splunk`: required values `SPLUNK_API_KEY`.

### Input fields

<ParamField path="collection" type="string" required>

Name of the KV Store collection containing the entry.

</ParamField>

<ParamField path="entry_key" type="string" required>

The _key value of the entry to delete from the collection.
Example: "5f3a1b2c3d4e5f6a7b8c9d0e"

</ParamField>

<ParamField path="app" type="string">

Splunk app context where the collection resides (e.g. "search" for default).

Default: `"search"`.

</ParamField>

<ParamField path="base_url" type="string | null">

Splunk base URL (e.g. https://localhost:8089 or https://tracecat.splunkcloud.com:8089).

Default: `null`.

</ParamField>

<ParamField path="owner" type="string">

Splunk namespace owner for access control (use "nobody" for shared access).

Default: `"nobody"`.

</ParamField>

<ParamField path="verify_ssl" type="boolean">

Whether to verify SSL certificates.

Default: `true`.

</ParamField>

## Discover fields

Action ID: `tools.splunk.discover_fields`

Discover fields in Splunk data using the fieldsummary command with statistics and sample values.

Reference: [https://help.splunk.com/en?resourceId=Splunk_SearchReference_Fieldsummary&amp;version=splunk-9_4](https://help.splunk.com/en?resourceId=Splunk_SearchReference_Fieldsummary&amp;version=splunk-9_4)

### Secrets

Required secrets:

- `splunk`: required values `SPLUNK_API_KEY`.

### Input fields

<ParamField path="end_time" type="string" required>

End time for the search.

</ParamField>

<ParamField path="start_time" type="string" required>

Start time for the search.

</ParamField>

<ParamField path="adhoc_search_level" type="string">

Adhoc search level.

Default: `"fast"`.

</ParamField>

<ParamField path="base_url" type="string | null">

Splunk base URL (e.g. https://localhost:8089).

Default: `null`.

</ParamField>

<ParamField path="index" type="string">

Index to search for fields. Use * for all indexes.

Default: `"*"`.

</ParamField>

<ParamField path="limit" type="integer">

Maximum number of fields to return.

Default: `100`.

</ParamField>

<ParamField path="max_values" type="integer">

Maximum number of sample values to return per field.

Default: `5`.

</ParamField>

<ParamField path="verify_ssl" type="boolean">

Whether to verify SSL certificates.

Default: `true`.

</ParamField>

## Get KV collection

Action ID: `tools.splunk.get_kv_collection`

Get configuration details for a specific KV Store collection from Splunk.

Reference: [https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#get-5](https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#get-5)

### Secrets

Required secrets:

- `splunk`: required values `SPLUNK_API_KEY`.

### Input fields

<ParamField path="collection" type="string" required>

Name of the KV Store collection to retrieve.

</ParamField>

<ParamField path="app" type="string">

Splunk app context where the collection resides (e.g. "search" for default).

Default: `"search"`.

</ParamField>

<ParamField path="base_url" type="string | null">

Splunk base URL (e.g. https://localhost:8089 or https://tracecat.splunkcloud.com:8089).

Default: `null`.

</ParamField>

<ParamField path="owner" type="string">

Splunk namespace owner for access control (use "nobody" for shared access).

Default: `"nobody"`.

</ParamField>

<ParamField path="verify_ssl" type="boolean">

Whether to verify SSL certificates.

Default: `true`.

</ParamField>

## Get KV entry

Action ID: `tools.splunk.get_kv_entry`

Get a specific entry from a KV Store collection in Splunk.

Reference: [https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#get-7](https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#get-7)

### Secrets

Required secrets:

- `splunk`: required values `SPLUNK_API_KEY`.

### Input fields

<ParamField path="collection" type="string" required>

Name of the KV Store collection containing the entry.

</ParamField>

<ParamField path="entry_key" type="string" required>

The _key value of the entry to retrieve from the collection.
Example: "5f3a1b2c3d4e5f6a7b8c9d0e"

</ParamField>

<ParamField path="app" type="string">

Splunk app context where the collection resides (e.g. "search" for default).

Default: `"search"`.

</ParamField>

<ParamField path="base_url" type="string | null">

Splunk base URL (e.g. https://localhost:8089 or https://tracecat.splunkcloud.com:8089).

Default: `null`.

</ParamField>

<ParamField path="owner" type="string">

Splunk namespace owner for access control (use "nobody" for shared access).

Default: `"nobody"`.

</ParamField>

<ParamField path="verify_ssl" type="boolean">

Whether to verify SSL certificates.

Default: `true`.

</ParamField>

## List data models

Action ID: `tools.splunk.list_data_models`

List all data models on the Splunk server using native Splunk search.

### Secrets

Required secrets:

- `splunk`: required values `SPLUNK_API_KEY`.

### Input fields

<ParamField path="adhoc_search_level" type="string">

Adhoc search level.

Default: `"fast"`.

</ParamField>

<ParamField path="base_url" type="string | null">

Splunk base URL (e.g. https://localhost:8089).

Default: `null`.

</ParamField>

<ParamField path="verify_ssl" type="boolean">

Whether to verify SSL certificates.

Default: `true`.

</ParamField>

## List field extractions

Action ID: `tools.splunk.list_field_extractions`

List all configured field extraction rules using a simple Splunk query.

### Secrets

Required secrets:

- `splunk`: required values `SPLUNK_API_KEY`.

### Input fields

<ParamField path="adhoc_search_level" type="string">

Adhoc search level.

Default: `"fast"`.

</ParamField>

<ParamField path="base_url" type="string | null">

Splunk base URL (e.g. https://localhost:8089).

Default: `null`.

</ParamField>

<ParamField path="verify_ssl" type="boolean">

Whether to verify SSL certificates.

Default: `true`.

</ParamField>

## List indexes

Action ID: `tools.splunk.list_indexes`

List all indexes on the Splunk server using native Splunk search.

### Secrets

Required secrets:

- `splunk`: required values `SPLUNK_API_KEY`.

### Input fields

<ParamField path="adhoc_search_level" type="string">

Adhoc search level.

Default: `"fast"`.

</ParamField>

<ParamField path="base_url" type="string | null">

Splunk base URL (e.g. https://localhost:8089).

Default: `null`.

</ParamField>

<ParamField path="verify_ssl" type="boolean">

Whether to verify SSL certificates.

Default: `true`.

</ParamField>

## List KV collections

Action ID: `tools.splunk.list_kv_collections`

List all KV Store collections in Splunk.

Reference: [https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#get-4](https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#get-4)

### Secrets

Required secrets:

- `splunk`: required values `SPLUNK_API_KEY`.

### Input fields

<ParamField path="app" type="string">

Splunk app context to list collections from (e.g. "search" for default).

Default: `"search"`.

</ParamField>

<ParamField path="base_url" type="string | null">

Splunk base URL (e.g. https://localhost:8089 or https://tracecat.splunkcloud.com:8089).

Default: `null`.

</ParamField>

<ParamField path="limit" type="integer">

Maximum number of collections to return.

Default: `100`.

</ParamField>

<ParamField path="offset" type="integer">

Number of collections to skip for pagination.

Default: `0`.

</ParamField>

<ParamField path="owner" type="string">

Splunk namespace owner for access control (use "nobody" for shared access).

Default: `"nobody"`.

</ParamField>

<ParamField path="search" type="string">

Search query to filter collections.
Example: "name=*whitelist*" to find collections with "whitelist" in the name.

Default: `""`.

</ParamField>

<ParamField path="sort_key" type="string">

Field to sort results by.

Default: `"_key"`.

</ParamField>

<ParamField path="sort_mode" type="string">

How to sort values ("auto", "num", "alpha_case", or "alpha").

Default: `"auto"`.

</ParamField>

<ParamField path="sort_order" type="string">

Sort order ("asc" or "desc").

Default: `"asc"`.

</ParamField>

<ParamField path="summarize" type="boolean">

Return summarized response with fewer details for faster response.

Default: `false`.

</ParamField>

<ParamField path="verify_ssl" type="boolean">

Whether to verify SSL certificates.

Default: `true`.

</ParamField>

## List KV entries

Action ID: `tools.splunk.list_kv_entries`

List entries in a KV Store collection from Splunk.

Reference: [https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#get-6](https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#get-6)

### Secrets

Required secrets:

- `splunk`: required values `SPLUNK_API_KEY`.

### Input fields

<ParamField path="collection" type="string" required>

Name of the KV Store collection to list entries from.

</ParamField>

<ParamField path="app" type="string">

Splunk app context where the collection resides (e.g. "search" for default).

Default: `"search"`.

</ParamField>

<ParamField path="base_url" type="string | null">

Splunk base URL (e.g. https://localhost:8089 or https://tracecat.splunkcloud.com:8089).

Default: `null`.

</ParamField>

<ParamField path="limit" type="integer">

Maximum number of entries to return.

Default: `100`.

</ParamField>

<ParamField path="offset" type="integer">

Number of entries to skip for pagination.

Default: `0`.

</ParamField>

<ParamField path="owner" type="string">

Splunk namespace owner for access control (use "nobody" for shared access).

Default: `"nobody"`.

</ParamField>

<ParamField path="query" type="object">

MongoDB-style query to filter entries.
Supported operators:
- Conditional: $gt, $gte, $lt, $lte, $ne
- Regex: $regex
- Logical: $and, $or, $not
Examples:
- &#123;"title": "Item"&#125; - Find entries where title equals "Item"
- &#123;"price": &#123;"$gt": 5&#125;&#125; - Find entries where price > 5
- &#123;"ip": &#123;"$regex": "192.168.1.*"&#125;&#125; - Find entries matching IP pattern

Default: `{}`.

</ParamField>

<ParamField path="shared" type="boolean">

Include entries from both specified owner and "nobody" user.

Default: `false`.

</ParamField>

<ParamField path="skip" type="integer">

Number of items to skip from the start (alternative to offset).

Default: `0`.

</ParamField>

<ParamField path="sort" type="string">

Field to sort entries by.

Default: `"_key"`.

</ParamField>

<ParamField path="verify_ssl" type="boolean">

Whether to verify SSL certificates.

Default: `true`.

</ParamField>

## List sourcetypes

Action ID: `tools.splunk.list_sourcetypes`

List all defined sourcetypes on the Splunk server.

Reference: [https://help.splunk.com/en?resourceId=Splunk_RESTREF_RESTsearch&amp;version=splunk-9_4](https://help.splunk.com/en?resourceId=Splunk_RESTREF_RESTsearch&amp;version=splunk-9_4)

### Secrets

Required secrets:

- `splunk`: required values `SPLUNK_API_KEY`.

### Input fields

<ParamField path="adhoc_search_level" type="string">

Adhoc search level.

Default: `"fast"`.

</ParamField>

<ParamField path="base_url" type="string | null">

Splunk base URL (e.g. https://localhost:8089).

Default: `null`.

</ParamField>

<ParamField path="verify_ssl" type="boolean">

Whether to verify SSL certificates.

Default: `true`.

</ParamField>

## Search events

Action ID: `tools.splunk.search_events`

Search events from Splunk.

Reference: [https://help.splunk.com/en?resourceId=Splunk_RESTREF_RESTsearch&amp;version=splunk-9_4#search.2Fjobs](https://help.splunk.com/en?resourceId=Splunk_RESTREF_RESTsearch&amp;version=splunk-9_4#search.2Fjobs)

### Secrets

Required secrets:

- `splunk`: required values `SPLUNK_API_KEY`.

### Input fields

<ParamField path="end_time" type="string" required>

End time for the search.

</ParamField>

<ParamField path="limit" type="integer" required>

Maximum number of events to return.

</ParamField>

<ParamField path="query" type="string" required>

Splunk (Splunk Query Language) search query. You MUST start the query with `search`, e.g. `search index=main | head 10`

</ParamField>

<ParamField path="start_time" type="string" required>

Start time for the search.

</ParamField>

<ParamField path="adhoc_search_level" type="string">

Adhoc search level.

Default: `"fast"`.

</ParamField>

<ParamField path="base_url" type="string | null">

Splunk base URL (e.g. https://localhost:8089).

Default: `null`.

</ParamField>

<ParamField path="verify_ssl" type="boolean">

Whether to verify SSL certificates.

Default: `true`.

</ParamField>

## Submit HEC event

Action ID: `tools.splunk.submit_hec_event`

Submit an event to Splunk using the HTTP Event Collector (HEC). Uses HEC token authentication.

Reference: [https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/9.4/get-data-with-http-event-collector/format-events-for-http-event-collector](https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/9.4/get-data-with-http-event-collector/format-events-for-http-event-collector)

### Secrets

Required secrets:

- `splunk_hec`: required values `SPLUNK_HEC_TOKEN`.

### Input fields

<ParamField path="event" type="object" required>

Event data to send to Splunk. Can contain any key-value pairs.
Example: &#123;"action": "login", "username": "john", "ip": "192.168.1.100"&#125;

</ParamField>

<ParamField path="base_url" type="string | null">

Splunk HEC endpoint URL (e.g. https://localhost:8088 or https://tracecat.splunkcloud.com:8088).

Default: `null`.

</ParamField>

<ParamField path="host" type="string">

Host field value for the event.

Default: `"tracecat.com"`.

</ParamField>

<ParamField path="index" type="string | null">

Splunk index to send the event to. If not specified, uses the default index configured for the HEC token.

Default: `null`.

</ParamField>

<ParamField path="source" type="string">

Event source identifier (e.g. application name, script name).

Default: `"tracecat_workflow"`.

</ParamField>

<ParamField path="sourcetype" type="string">

Event source type for categorization and parsing rules.

Default: `"tracecat_log"`.

</ParamField>

<ParamField path="verify_ssl" type="boolean">

Whether to verify SSL certificates.

Default: `true`.

</ParamField>

## Update KV entry

Action ID: `tools.splunk.update_kv_entry`

Update an existing entry in a KV Store collection in Splunk.

Reference: [https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#post-12](https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions#post-12)

### Secrets

Required secrets:

- `splunk`: required values `SPLUNK_API_KEY`.

### Input fields

<ParamField path="collection" type="string" required>

Name of the KV Store collection containing the entry.

</ParamField>

<ParamField path="entry_key" type="string" required>

The _key value of the entry to update in the collection.
Example: "5f3a1b2c3d4e5f6a7b8c9d0e"

</ParamField>

<ParamField path="fields" type="object" required>

Fields to update in the entry. Only specified fields will be updated.
Example: &#123;"status": "completed", "updated_at": "2024-01-15"&#125;

</ParamField>

<ParamField path="app" type="string">

Splunk app context where the collection resides (e.g. "search" for default).

Default: `"search"`.

</ParamField>

<ParamField path="base_url" type="string | null">

Splunk base URL (e.g. https://localhost:8089 or https://tracecat.splunkcloud.com:8089).

Default: `null`.

</ParamField>

<ParamField path="owner" type="string">

Splunk namespace owner for access control (use "nobody" for shared access).

Default: `"nobody"`.

</ParamField>

<ParamField path="verify_ssl" type="boolean">

Whether to verify SSL certificates.

Default: `true`.

</ParamField>

## Upload CSV to KV Collection

Action ID: `tools.splunk.upload_csv_to_kv_collection`

Download a CSV file and upload its rows to a Splunk KV Store collection with create, append, or override modes.

Reference: [https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions](https://help.splunk.com/en/splunk-enterprise/rest-api-reference/9.4/kv-store-endpoints/kv-store-endpoint-descriptions)

### Secrets

Required secrets:

- `splunk`: required values `SPLUNK_API_KEY`.

### Input fields

<ParamField path="collection" type="string" required>

Name of the KV Store collection to target.

</ParamField>

<ParamField path="csv_url" type="string" required>

URL pointing to the CSV file to ingest.

</ParamField>

<ParamField path="app" type="string">

Splunk app context (e.g. search).

Default: `"search"`.

</ParamField>

<ParamField path="base_url" type="string | null">

Splunk base URL (e.g. https://localhost:8089 or https://example.splunkcloud.com:8089). If not provided, falls back to the workspace variable `splunk.base_url`.

Default: `null`.

</ParamField>

<ParamField path="batch_size" type="integer">

Number of CSV rows to send per request. Lower this if you hit payload limits.

Default: `500`.

</ParamField>

<ParamField path="csv_headers" type="map[string, string] | null">

Optional HTTP headers for downloading the CSV (e.g. Authorization).

Default: `null`.

</ParamField>

<ParamField path="mode" type="string">

create: new collection, error if it exists. append: add to existing collection, error if missing. override: replace existing collection if present.

Default: `"create"`.

Allowed values: `create`, `append`, `override`.

</ParamField>

<ParamField path="owner" type="string">

Splunk namespace owner (use "nobody" for shared access).

Default: `"nobody"`.

</ParamField>

<ParamField path="verify_ssl" type="boolean">

Whether to verify SSL certificates when downloading and uploading.

Default: `true`.

</ParamField>
