Splunk

The Splunk integration sends Elastio events to a Splunk HTTP Event Collector (HEC). Each destination is a Splunk config. Through the API you can check how deliveries are going: totals for a time period, the full delivery history, and the request and response for each attempt.

Check delivery health

GET

/gateway/integration/v1/splunk/statisticsGet Splunk delivery statistics

Try it

Returns totals across all Splunk configs for a period such as 24h, 7d or 30d (default 7d).

curl "https://acme.app.elastio.com/gateway/integration/v1/splunk/statistics?period=7d" \
  -H "Authorization: Bearer $ELASTIO_TOKEN"

import os, requests

BASE = "https://acme.app.elastio.com"
HEADERS = {"Authorization": f"Bearer {os.environ['ELASTIO_TOKEN']}"}

resp = requests.get(f"{BASE}/gateway/integration/v1/splunk/statistics", headers=HEADERS, params={"period": "7d"}, timeout=30)
resp.raise_for_status()
stats = resp.json()["data"]
print(f"{stats['failed_deliveries']} of {stats['total_deliveries']} deliveries failed")

$Base = "https://acme.app.elastio.com"
$Headers = @{ Authorization = "Bearer $env:ELASTIO_TOKEN" }
(Invoke-RestMethod -Uri "$Base/gateway/integration/v1/splunk/statistics?period=7d" -Headers $Headers).data

{
  "status": 200,
  "data": {
    "total_splunk_configs": 3,
    "active_splunk_configs": 2,
    "inactive_splunk_configs": 1,
    "total_deliveries": 4,
    "successful_deliveries": 2,
    "failed_deliveries": 1,
    "period_days": 7
  },
  "message": "success"
}

Find the filter values

GET

/gateway/integration/v1/splunk/invocations/filter-optionsGet filter options for Splunk invocations list

Try it

Returns the Splunk config names and status values you can use to filter the invocation history. It takes the same period as the history.

curl "https://acme.app.elastio.com/gateway/integration/v1/splunk/invocations/filter-options?period=30d" \
  -H "Authorization: Bearer $ELASTIO_TOKEN"

resp = requests.get(f"{BASE}/gateway/integration/v1/splunk/invocations/filter-options", headers=HEADERS, params={"period": "30d"}, timeout=30)
resp.raise_for_status()
print(resp.json()["splunk_names"])

Invoke-RestMethod -Uri "$Base/gateway/integration/v1/splunk/invocations/filter-options?period=30d" -Headers $Headers

{
  "splunk_names": ["Production HEC", "Staging"],
  "statuses": ["scheduled", "in_progress", "delivered", "failed", "retryable"]
}

Investigate failed deliveries

GET

/gateway/integration/v1/splunk/invocationsGet Splunk invocation history (all configs)

Try it

Delivery history across all Splunk configs. Filter by period, name (a config name, or all) and status (scheduled, in_progress, delivered, failed, retryable or all). Each invocation includes the HEC response code, the payload sent and any error. Results page with pageSize (1–100, default 50) and pageToken; the next token is in pagination.next_page_token.

curl "https://acme.app.elastio.com/gateway/integration/v1/splunk/invocations" -G \
  -H "Authorization: Bearer $ELASTIO_TOKEN" \
  --data-urlencode "period=24h" \
  --data-urlencode "status=failed" \
  --data-urlencode "name=Production HEC" \
  | jq '.invocations[] | {created_at, splunk_name, http_status_code, error_message, retry_count}'

params = {"period": "24h", "status": "failed", "pageSize": 100}
while True:
    resp = requests.get(f"{BASE}/gateway/integration/v1/splunk/invocations", headers=HEADERS, params=params, timeout=30)
    resp.raise_for_status()
    body = resp.json()
    for inv in body["invocations"]:
        print(inv.get("created_at"), inv.get("splunk_name"), inv.get("http_status_code"), inv.get("error_message"))
    token = body["pagination"].get("next_page_token")
    if not token:
        break
    params["pageToken"] = token

$page = Invoke-RestMethod -Uri "$Base/gateway/integration/v1/splunk/invocations?period=24h&status=failed" -Headers $Headers
$page.invocations | Select-Object created_at, splunk_name, http_status_code, error_message, retry_count
"Total matching: $($page.pagination.total_count)"

{
  "invocations": [
    {
      "id": "6c1d9e2a-7f3b-4a8e-b5d0-1e2f3a4b5c6d",
      "splunk_id": "0a9b8c7d-6e5f-4a3b-9c2d-1e0f9a8b7c6d",
      "splunk_name": "Production HEC",
      "event_type": "…",
      "status": "failed",
      "http_status_code": 403,
      "response_time_ms": 182,
      "error_message": "…",
      "retry_count": 3,
      "created_at": "2026-10-11T14:02:17Z",
      "updated_at": "2026-10-11T14:09:40Z"
    }
  ],
  "pagination": {
    "next_page_token": null,
    "prev_page_token": null,
    "total_count": 1
  }
}

To look at one config only, use GET /gateway/integration/v1/splunk/{splunk_id}/invocations with the config’s ID from splunk_id above. It takes the same filters except name.

All endpoints

Splunk

4 operations in the reference →