Loading integration
Enterprise access
Agent Serve is available to teams by invitation. Tell us what you want to build and we will set up your workspace with you.
Agent Serve · Observability integration
Run SPL searches and manage saved searches and alerts in Splunk
Splunk is a Observability integration for Agent Serve, the AI workspace where teams build and deploy AI agents. Agent Serve's Splunk integration provides 12 Splunk tools that AI agents can use inside Agent Serve's visual workflow builder. Splunk connects with an API key. Explore deployment options with the Agent Serve team.
Last updated
Integrate Splunk Enterprise or Splunk Cloud into workflows. Run SPL searches synchronously or as asynchronous jobs, fetch results, dispatch saved searches, and inspect fired alerts and indexes.
Agent Serve accounts are created by invitation. Request access for your team, or accept an invitation from your workspace admin, then sign in.
Open your workspace, drag a Splunk block onto the workflow builder, and paste in your Splunk API key.
Pick the tool you need, wire in an AI agent for reasoning or data transformation, and run. Your Splunk automation is live.
12 Splunk tools available in Agent Serve.
Run an SPL search synchronously and return its results in a single call (oneshot mode). A oneshot search buffers the whole result set in one response with no paging, so use it for short searches; for anything large use Create Search Job with Get Search Results, which defaults to 100 rows and pages with offset.
Start a Splunk search job and return its search ID (sid). The search runs asynchronously — poll its status and fetch results separately.
Get the status and progress of a Splunk search job by search ID, including dispatch state, completion progress, and event/result counts.
Fetch the transformed results of a completed Splunk search job by search ID, with pagination.
Cancel a running Splunk search job and delete its result cache.
List saved searches and reports configured in Splunk, including their SPL, schedule, and alert configuration.
Get the configuration of a single Splunk saved search by name, including its SPL, schedule, and alert settings.
Run a Splunk saved search immediately and return the search ID (sid) of the dispatched job.
List the saved searches with currently triggered (unexpired) Splunk alerts and how many times each has fired.
List the unexpired triggered instances of a Splunk alert by saved search name, including severity, trigger time, and the search ID of each firing.
List the indexes configured on the Splunk instance with their size, event count, and retention settings.
List the apps installed on the Splunk instance with their label, version, author, and enabled state.
Ready-to-use templates featuring Splunk. Click any to build it instantly.
Agent Serve's Splunk integration adds 12 Splunk tools to the AI agents you build in Agent Serve's visual workflow builder — you build it all visually. Run SPL searches and manage saved searches and alerts in Splunk. Teams often pair Splunk with Affinity and Rippling in the same agent.
Agent Serve is available to teams by invitation. Request access and the team will map out the Splunk agents, connections, and team access your process needs.