Splunk
Splunk is a platform for searching, monitoring, and analyzing machine-generated big data via a web-style interface.
Reference-quality API operations across every facet — a rich contract, published governance, transparent operations, and machine-readable commercial terms.
API Evangelist profiles Splunk the way a machine reads it — 176 machine-readable artifacts across 14 APIs, pulled from the provider's own public surface and indexed so a developer, an analyst, or an AI agent can evaluate it against every other provider on the network.
Every provider in the network is reduced to the same set of machine-readable artifacts — OpenAPI contracts, event specifications, GraphQL schemas, runnable collections, pricing and rate-limit signals, security posture, OAuth scopes, and the agent surfaces (MCP servers and skills) that let software drive the API on its own. We profile them because the interface is the part of a company you can actually inspect: it is a truer signal of what a provider does than any marketing page. From those artifacts we compute the Kin Score — Splunk scores 75.7/100 (exemplar), with a separate agent-readiness read of 60/100 (agent ready). The full breakdown is below, followed by every artifact we hold — each card links through to its machine-readable definition on apis.io.
Kin Score
This is the API Evangelist rating — a single, repeatable read computed from the artifacts on this page. Green fill is points earned; the red track is points possible, so every bar shows earned-versus-possible at a glance.
Kin Score
How this is scored →scored 2026-07-27 · rubric v0.5
How we profile Splunk
Each block below is one kind of artifact we hold for Splunk. For each we say what it is and why it earns a place in the profile, then list every one we've indexed — capped at two rows, scroll within the panel for the rest.
APIs 14
Each API is captured as its own OpenAPI definition — every operation, parameter, and response. This is the single most useful machine-readable description of what an API does, and it's what lets us score, lint, mock, and generate against it without asking the provider for anything.
Individual APIs this provider publishes, each with its own machine-readable definition.
Splunk
API monitoring checks to see if API-connected resources are available, working properly and responding to calls.
Splunk Cloud Platform REST API
The Splunk Cloud Platform REST API provides a subset of the Splunk Enterprise REST API endpoints for managing and interacting with your Splunk Cloud Platform deployment. Access ...
Splunk Cloud Admin Config Service (ACS) API
The Admin Config Service (ACS) is a cloud-native API that provides programmatic self-service administration capabilities for Splunk Cloud Platform. Administrators can use the AC...
Splunk Observability Cloud API
The Splunk Observability Cloud API provides REST endpoints for sending and managing metrics, traces, and events. It supports infrastructure monitoring, application performance m...
Splunk SOAR REST API
The Splunk SOAR REST API enables programmatic creation, updating, and management of security automation objects including containers, assets, playbooks, indicators, lists, and a...
Splunk Enterprise Security API
The Splunk Enterprise Security API provides REST endpoints for accessing and modifying findings, investigations, risk scores, assets, and identities in Splunk Enterprise Securit...
Splunk IT Service Intelligence (ITSI) REST API
The Splunk IT Service Intelligence (ITSI) REST API allows bulk creation and updating of ITOA interface objects such as entities, services, and KPI base searches. ITSI is a monit...
Splunk HTTP Event Collector (HEC) API
The Splunk HTTP Event Collector (HEC) is a high-performance REST API data input that accepts JSON or raw text data sent over HTTP or HTTPS. It uses token-based authentication an...
Splunk Intelligence Management API
The Splunk Intelligence Management (formerly ThreatStream) API provides REST v2.0 endpoints for managing threat intelligence data including indicators, observables, and intellig...
Splunk SOAR Playbook Automation API
The Splunk SOAR Playbook Automation API provides Python APIs for developing playbooks and automation within Splunk SOAR. It includes container, playbook, data access, vault, net...
Splunk AppInspect API
The Splunk AppInspect API validates Splunk apps and add-ons against Splunk best practices and requirements for publishing to Splunkbase or installing on Splunk Cloud Platform. I...
Splunk Data Inputs API
Endpoints for configuring and managing data inputs including monitors, TCP/UDP inputs, scripted inputs, and HTTP Event Collector (HEC) tokens. Data inputs define how Splunk inge...
Splunk Index API
Endpoints for managing Splunk indexes, which store and organize ingested data. Indexes can be created, modified, listed, and configured for retention and storage policies.
Splunk Search API
Endpoints for creating, managing, and retrieving search jobs and their results. Splunk search processing language (SPL) queries are submitted as search jobs that run asynchronou...
Scroll within the panel for all 14 ·
Postman Collections 1
A runnable collection turns the contract into something a developer can execute in seconds. We profile them because the fastest way to trust an API is to make a real call against it.
Ready-to-run Postman collections for exercising this provider's APIs.
Splunk Enterprise REST API
POSTMANOpen Collections 1
Open, tool-agnostic collections carry the same runnable value as Postman without locking you to one client — the portable, forkable form of the same exercise.
Open, tool-agnostic API collections (OpenAPI-derived and Bruno).
Splunk Enterprise REST API
OPEN COLLECTIONArazzo Workflows 6
Real integrations are rarely a single call. Arazzo describes the multi-step sequences — auth, then create, then confirm — so both a human and an agent can follow the choreography, not just the endpoints.
Multi-step API workflows described with the Arazzo specification.
Splunk Finalize, Read, and Clean Up a Search Job
Dispatch a long search, finalize it early, read partial results, then delete the job.
ARAZZOSplunk HEC Ingest an Event and Confirm Indexing
Provision a HEC token with acknowledgment, send a JSON event, and confirm it was indexed.
ARAZZOSplunk Provision an Index and Attach a Monitor Input
Create an event index, verify it, then create a file monitor input that feeds it.
ARAZZOSplunk Ingest Raw Data then Search for It
Send raw text to HEC, then run an SPL search and poll it to confirm the data landed.
ARAZZOSplunk Run a Search Job and Retrieve Results
Dispatch an SPL search, poll the job until it finishes, then read the results.
ARAZZOSplunk Search and Retrieve Raw Events
Run an SPL search, wait for it to finish, then pull the untransformed events.
ARAZZOMCP Servers 1
Model Context Protocol servers expose these APIs directly to AI agents. We profile them because agent-native access is the fastest-growing way this provider's capabilities actually get used.
Model Context Protocol servers that expose these APIs to AI agents.
MCP Server
MCP SERVERGraphQL 1
Where a provider ships GraphQL, the schema is the contract. We profile it alongside the REST surface so the whole interface is legible in one place.
GraphQL schemas published by this provider.
Splunk GraphQL Schema
Conceptual GraphQL schema for the Splunk platform, covering search, indexing, data inputs, access control, dashboards, saved searches, metrics, clustering, licensing, and diagno...
GRAPHQLPricing Plans 1
Pricing is part of the interface. Machine-readable plans tell you what a tier costs and includes before you commit — one of the six things the Kin Score reads for commercial clarity.
Published pricing tiers and plan structures.
Splunk Plans Pricing
PLANSRate Limits 1
Rate limits are the difference between a demo that works and a production integration that doesn't fall over. Publishing them is an operational-transparency signal — and a hard requirement for any agent that plans its own throughput.
Documented rate limits and quota policies.
Splunk Rate Limits
RATE LIMITSFinOps 1
Cost, billing, and metering signals let a buyer model the financial operations of an API before it's live. We profile them for the same reason we profile pricing: the money is part of the contract.
Cost, billing, and metering signals for API financial operations.
Splunk Finops
FINOPSFeatures 8
The notable capabilities this provider advertises, captured as structured features so they can be searched and compared instead of read one landing page at a time.
Notable capabilities this provider offers.
Scroll within the panel for all 8 ·
Semantic Vocabularies 2
JSON-LD contexts give the data shared meaning across APIs. We profile them because semantics are what let a machine reconcile 'customer' here with 'customer' somewhere else.
JSON-LD contexts and semantic vocabularies used across these APIs.
Splunk Context
JSON-LDSpectral Rules 2
Governance rulesets we run against this provider's specs — the automated checks behind parts of the score. Profiling them makes the quality bar explicit and re-runnable, not a matter of opinion.
Splunk API Rules
SPECTRALSplunk API Rules
SPECTRALJSON Schema 48
Standalone JSON Schema definitions describe the data models behind the API. We profile them so the shapes are validatable on their own — useful long after a single request is forgotten.
Standalone JSON Schema definitions for this provider's data models.
ErrorResponse
JSON SCHEMAHecEvent
JSON SCHEMAHecResponse
JSON SCHEMAHecTokenCreateRequest
JSON SCHEMAHecTokenList
JSON SCHEMAHecToken
JSON SCHEMAIndexCreateRequest
JSON SCHEMAIndexList
JSON SCHEMAIndex
JSON SCHEMAIndexUpdateRequest
JSON SCHEMAMonitorInputCreateRequest
JSON SCHEMAMonitorInputList
JSON SCHEMAMonitorInput
JSON SCHEMAMonitorInputUpdateRequest
JSON SCHEMAPaging
JSON SCHEMASearchJobCreateRequest
JSON SCHEMASearchJobList
JSON SCHEMASearchJob
JSON SCHEMASearchResults
JSON SCHEMATcpInputList
JSON SCHEMATcpInput
JSON SCHEMAUdpInputList
JSON SCHEMAUdpInput
JSON SCHEMAErrorResponse
JSON SCHEMASplunk Event
JSON SCHEMAHecEvent
JSON SCHEMAHecResponse
JSON SCHEMAHecToken
JSON SCHEMAHecTokenCreateRequest
JSON SCHEMAHecTokenList
JSON SCHEMAIndex
JSON SCHEMAIndexCreateRequest
JSON SCHEMAIndexList
JSON SCHEMAIndexUpdateRequest
JSON SCHEMAMonitorInput
JSON SCHEMAMonitorInputCreateRequest
JSON SCHEMAMonitorInputList
JSON SCHEMAMonitorInputUpdateRequest
JSON SCHEMAPaging
JSON SCHEMASplunk Search Job
JSON SCHEMASearchJob
JSON SCHEMASearchJobCreateRequest
JSON SCHEMASearchJobList
JSON SCHEMASearchResults
JSON SCHEMATcpInput
JSON SCHEMATcpInputList
JSON SCHEMAUdpInput
JSON SCHEMAUdpInputList
JSON SCHEMAScroll within the panel for all 48 ·
JSON Structure 24
JSON Structure captures the data shapes in a form built for tooling — a complement to JSON Schema that keeps the model machine-legible.
JSON Structure definitions describing this provider's data shapes.
Splunk Enterprise Rest Error Response Structure
JSON STRUCTURESplunk Enterprise Rest Hec Event Structure
JSON STRUCTURESplunk Enterprise Rest Hec Response Structure
JSON STRUCTURESplunk Enterprise Rest Hec Token List Structure
JSON STRUCTURESplunk Enterprise Rest Hec Token Structure
JSON STRUCTURESplunk Enterprise Rest Index Create Request Structure
JSON STRUCTURESplunk Enterprise Rest Index List Structure
JSON STRUCTURESplunk Enterprise Rest Index Structure
JSON STRUCTURESplunk Enterprise Rest Index Update Request Structure
JSON STRUCTURESplunk Enterprise Rest Monitor Input List Structure
JSON STRUCTURESplunk Enterprise Rest Monitor Input Structure
JSON STRUCTURESplunk Enterprise Rest Paging Structure
JSON STRUCTURESplunk Enterprise Rest Search Job List Structure
JSON STRUCTURESplunk Enterprise Rest Search Job Structure
JSON STRUCTURESplunk Enterprise Rest Search Results Structure
JSON STRUCTURESplunk Enterprise Rest Tcp Input List Structure
JSON STRUCTURESplunk Enterprise Rest Tcp Input Structure
JSON STRUCTURESplunk Enterprise Rest Udp Input List Structure
JSON STRUCTURESplunk Enterprise Rest Udp Input Structure
JSON STRUCTURESplunk Structure
JSON STRUCTUREScroll within the panel for all 24 ·
Examples 46
Real request and response payloads are what turn a spec from abstract into obvious — and they're one of the twelve things an agent needs to call an API correctly on the first try.
Example request and response payloads for these APIs.
Splunk Createindex Example
EXAMPLESplunk Getindex Example
EXAMPLESplunk Getsearchjob Example
EXAMPLESplunk Listindexes Example
EXAMPLESplunk Listudpinputs Example
EXAMPLESplunk Sendevent Example
EXAMPLESplunk Sendrawevent Example
EXAMPLESplunk Updateindex Example
EXAMPLEScroll within the panel for all 46 ·
Security Posture 4
Authentication, domain security, vulnerability disclosure, and trust-center signals — the evidence that a provider takes security seriously enough to document it. We profile it because you can't govern what you can't see.
Authentication, domain security, vulnerability disclosure, and trust-center signals.
Splunk Trust Center
SOC 2, ISO 27001, ISO 27017, ISO 27018, PCI DSS, HIPAA, FedRAMP, GDPR, CSA STAR
SECURITYAgentic Access 1
An x-agentic-access contract marks which operations are safe for an agent to run on its own and which need a human in the loop. It is the difference between an API an agent can use and one it can use safely.
Recommended x-agentic-access execution contracts for AI agents.
Use Cases 6
What developers actually build with this provider — captured so the catalogue answers 'what is this for', not just 'what does this expose'.
What developers build with this provider.
Security Information and Event Management
Centralize security event data for real-time threat detection, investigation, and compliance reporting.
IT Operations Monitoring
Monitor infrastructure health, application performance, and service availability across hybrid environments.
Log Management
Collect, index, and analyze log data from servers, applications, and network devices for troubleshooting.
Incident Response Automation
Automate security incident triage, enrichment, and response using SOAR playbooks and integrations.
Application Performance Monitoring
Trace application requests end-to-end to identify bottlenecks and optimize performance.
Compliance and Audit
Generate compliance reports and audit trails from indexed data to meet regulatory requirements.
Integrations 8
Pre-built integrations with other platforms tell you where this provider already fits in a stack.
Pre-built integrations with other platforms and tools.
AWS
Ingest and analyze AWS CloudTrail, CloudWatch, VPC Flow Logs, and other AWS service data.
Azure
Collect and analyze Azure activity logs, metrics, and diagnostic data.
Google Cloud
Ingest Google Cloud audit logs, metrics, and Pub/Sub messages for cloud monitoring.
Kubernetes
Monitor Kubernetes clusters with metrics, logs, and events from containers and orchestration.
ServiceNow
Integrate Splunk alerts and incidents with ServiceNow ITSM for ticketing and workflow automation.
PagerDuty
Trigger PagerDuty incidents from Splunk alerts for on-call notification and escalation.
Cisco
Collect and analyze Cisco network device logs, firewall events, and security telemetry.
CrowdStrike
Ingest CrowdStrike Falcon endpoint detection data for correlated threat analysis.
Scroll within the panel for all 8 ·
Resources
Every other property we hold for Splunk — documentation, portals, status pages, policies, and corporate surface — grouped by the job it does, following the integrator's arc from getting started to running in production.
Get Started 4
Portal, sign-up, and the first successful call
Documentation 6
Reference material describing how the API behaves
Agent Surfaces 2
MCP servers, agent skills, and machine-readable catalogs
Design & Contract 7
Pagination, idempotency, versioning, errors, and events
Scroll within the panel for all 7 ·
Build 8
SDKs, sample code, and the tooling you integrate with
Scroll within the panel for all 8 ·
Access & Security 7
Authentication, authorization, and security posture
Scroll within the panel for all 7 ·
Operate 5
Status, limits, changes, and where to get help
Commercial 4
Pricing, plans, and the legal terms of use
Company 2
The organization behind the API
Other 2
Properties that don't map to a standard resource type
← All providers · Data indexed from github.com/api-evangelist/splunk · machine-readable index on apis.io