Skip to main content

​
Overview

The Splunk integration lets Cotool agents investigate and hunt in your Splunk data. It provides:
  1. Data discovery — list indexes and sourcetypes, and get the exact field names, types, and example values for a sourcetype before writing SPL.
  2. SPL searches — run ad-hoc search jobs over explicit time ranges and page through their results.
  3. Detections — list Splunk saved searches and create new ones.
Cotool connects to the Splunk REST API with a Splunk authentication token. Every search runs as the Splunk user the token belongs to, so that user’s roles decide which indexes Cotool can search.

​
Create a Splunk token

1

Open the tokens page

In Splunk Web, click Settings > Tokens, then click New Token. If the page says token authentication is not enabled, a Splunk admin must turn it on first.
2

Configure the token

Set User to a dedicated Splunk user with search access to the indexes Cotool needs. Do not use an admin account. Enter Cotool as the Audience, and set an Expiration. If you leave the expiration empty, the token expires after 30 days.
3

Copy the token

Click Create and copy the whole token. Splunk shows it only once.

​
Connect in Cotool

  1. Go to Integrations in the Cotool sidebar, open Splunk, and click Connect.
  2. Enter your connection details:
  1. Click Connect. Cotool starts building an environment map right away.

​
Available Tools

When an agent has the Splunk integration enabled, it can use these tools: splunk_createDetection is the only tool that changes your Splunk configuration. The other tools read data and settings.

​
How Cotool searches Splunk

  • Agents discover before they query. Agents list indexes and sourcetypes, then check a sourcetype’s fields, so their SPL uses real field names.
  • Searches name their indexes. Cotool rejects searches over index=* and searches with leading wildcards such as field=*value, because both are slow on large deployments. Agents search concrete indexes and use TERM() for exact values such as IP addresses.
  • Searches have a time limit. When a search reaches the query timeout you set, Cotool finalizes the job and returns the results found so far, to conserve Splunk resources.
  • Large results are paged. A search returns its first page of results, and agents fetch the rest of a completed job page by page.
  • Cotool Logs come first. If a log source is also ingested into Cotool Logs, agents query it there, and use Splunk for data only Splunk holds or when you ask for Splunk.

​
Environment map

After you connect, and weekly after that, Cotool maps your Splunk environment: your indexes, the sourcetypes in each, their key fields, and sample rows. View the map on the Splunk integration page in Cotool. Agents use the map to choose where to search, and they can still discover data added since the last run.