---
warning: DO NOT CHANGE THIS MANUALLY, THIS IS GENERATED BY https://github.com/duckdb/community-extensions repository, check README there
title: splunk
excerpt: |
  DuckDB Community Extensions
  Read logs from a Splunk search REST API into OTLP-shaped tables

extension:
  name: splunk
  description: Read logs from a Splunk search REST API into OTLP-shaped tables
  version: 0.2.0
  language: C++
  build: cmake
  license: MIT
  requires_toolchains: "cmake, openssl"
  maintainers:
    - smithclay

repo:
  github: smithclay/duckdb-splunk
  ref: 1c69eeecba53c63b0e1f5eb07c7933757daf1355

docs:
  hello_world: |
    -- Store your Splunk credentials once (kept out of query text; redacted in duckdb_secrets()).
    CREATE SECRET (
        TYPE splunk,
        URL 'https://splunk.example.com:8089',
        USERNAME '<username>',
        PASSWORD '<password>'
    );

    -- Or authenticate with a token instead of a username/password.
    CREATE SECRET (
        TYPE splunk,
        URL 'https://splunk.example.com:8089',
        TOKEN '<token>',
        TOKEN_TYPE 'bearer'   -- 'bearer' for JWT auth tokens, 'splunk' for session keys
    );

    -- Run SPL and get back OTLP log rows.
    SELECT time_unix_nano, service_name, severity_text, body
    FROM read_splunk_logs(
        query    => 'index=main error',
        earliest => '-1h',
        latest   => 'now'
    );
  extended_description: |
    This extension reads logs from a [Splunk search REST API](https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch)
    endpoint directly into DuckDB. Rows conform to the OTLP logs schema (matching
    [duckdb-otlp](https://github.com/smithclay/otlp2records) `read_otlp_logs`), so Splunk events drop
    straight into an OTLP-shaped lakehouse alongside data from other sources. Resource attribute keys
    align with the OpenTelemetry Collector's Splunk receivers (`host.name`, `com.splunk.*`) for interop.

    Features:
    - **Credentials via DuckDB secrets** (`CREATE SECRET (TYPE splunk, ...)`), supporting basic auth
      or token auth; `PASSWORD`/`TOKEN` are redacted in `duckdb_secrets()`. Set `INSECURE_TLS true`
      for instances with self-signed certificates.
    - **HEC/JSON event awareness**: Splunk does not extract JSON event fields at search time, so the
      extension parses `_raw` and resolves fields such as `level`, `trace_id`, and `service` from it
    - **Automatic retries** for rate limits (HTTP 429), HTTP 5xx, and transient network errors;
      retry waits honor query cancellation
    - **Projection pushdown**: only selected columns are decoded, so aggregations skip the per-row
      `_raw` parse and attribute JSON serialization
    - **Loud failures on bad SPL**: server-side search errors are raised rather than looking like zero matches
    - Splunk fields not mapped to the OTLP schema are exposed as JSON in `log_attributes` for use with
      DuckDB's JSON functions

    `read_splunk_logs` accepts `query` (SPL, default `*`), `earliest` (default `-15m`), `latest`
    (default `now`), `max_rows` (`0` = unlimited), `timeout`, `retries`, and `secret` (to select a
    named secret). Logs are supported today. For full documentation, visit the
    [extension repository](https://github.com/smithclay/duckdb-splunk).

extension_star_count: 2
extension_star_count_pretty: 2
extension_download_count: 824
extension_download_count_pretty: 824
image: '/images/community_extensions/social_preview/preview_community_extension_splunk.png'
layout: community_extension_doc
---
### Compatibility Matrix

This table covers all DuckDB releases that have not reached [end-of-life](https://duckdb.org/release_calendar), including LTS releases, and shows the 2 most recent patch releases of each. Older patch releases are not listed, but the extension may be available for them as well.

<div class="extension_compatibility_table"></div>

| Platform | 1.4.4 | 1.4.5 | 1.5.5 | 1.5.6 | 2.0.0 |
| :--- | :---: | :---: | :---: | :---: | :---: |
| Linux AMD64 | ❌ | ❌ | ✅ | ✅ | ❌ |
| Linux ARM64 | ❌ | ❌ | ✅ | ✅ | ❌ |
| macOS AMD64 | ❌ | ❌ | ✅ | ✅ | ❌ |
| macOS ARM64 | ❌ | ❌ | ✅ | ✅ | ❌ |
| Windows AMD64 | ❌ | ❌ | ✅ | ✅ | ❌ |
| Windows ARM64 | ❌ | ❌ | ❌ | ❌ | ❌ |
| WebAssembly | ❌ | ❌ | ✅ | ✅ | ❌ |

### Installing and Loading
```sql
INSTALL {{ page.extension.name }} FROM community;
LOAD {{ page.extension.name }};
```

{% if page.docs.hello_world %}
### Example
```sql
{{ page.docs.hello_world }}```
{% endif %}

{% if page.docs.extended_description %}
### About {{ page.extension.name }}
{{ page.docs.extended_description }}
{% endif %}
### Added Functions

<div class="extension_functions_table"></div>

|  function_name   | function_type | description | comment | examples |
|------------------|---------------|-------------|---------|----------|
| read_splunk_logs | table         | NULL        | NULL    |          |

### Overloaded Functions

<div class="extension_functions_table"></div>

This extension does not add any function overloads.

### Added Types

<div class="extension_types_table"></div>

This extension does not add any types.

### Added Settings

<div class="extension_settings_table"></div>

This extension does not add any settings.