search_splunk
Execute search queries on Splunk Enterprise/Cloud to retrieve data within specified time ranges and result limits, facilitating efficient log analysis and insights extraction.
Instructions
Execute a Splunk search query and return the results.
Args:
search_query: The search query to execute
earliest_time: Start time for the search (default: 24 hours ago)
latest_time: End time for the search (default: now)
max_results: Maximum number of results to return (default: 100)
Returns:
List of search results
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| earliest_time | No | -24h | |
| latest_time | No | now | |
| max_results | No | ||
| search_query | Yes |
Input Schema (JSON Schema)
{
"properties": {
"earliest_time": {
"default": "-24h",
"title": "Earliest Time",
"type": "string"
},
"latest_time": {
"default": "now",
"title": "Latest Time",
"type": "string"
},
"max_results": {
"default": 100,
"title": "Max Results",
"type": "integer"
},
"search_query": {
"title": "Search Query",
"type": "string"
}
},
"required": [
"search_query"
],
"title": "search_splunkArguments",
"type": "object"
}