Splunk integration - search, export, job management, and evidence ingestion.
This command reads the following keys from init.yaml. Any of them can also be supplied as an environment variable of the same name. See CLI Configuration File for the full reference.
Command Description regscale splunk configShow current Splunk configuration. regscale splunk exportExport large search results to file. regscale splunk export-advancedExport search results with format and compression options. regscale splunk get-job-eventsFetch raw events from one or more existing Splunk jobs by SID. regscale splunk get-job-resultsFetch processed results from one or more existing Splunk jobs by SID. regscale splunk ingest-evidenceCreate RegScale Evidence (linked to controls) from Splunk saved-search results. regscale splunk list-jobsList all Splunk search jobs visible to the authenticated user. regscale splunk processProcess Splunk search results into RegScale assets and findings. regscale splunk run-savedRun a saved search by name. regscale splunk saved-searchesList saved searches. regscale splunk searchExecute SPL search query. regscale splunk syncRun the configured Splunk saved searches and import the results into RegScale. regscale splunk test-connectionTest connection to Splunk server. regscale splunk upload-hecUpload a file into Splunk via HTTP Event Collector.
Show current Splunk configuration.
This command takes no parameters.
Export large search results to file.
Shell
regscale splunk export [OPTIONS]
Argument Type Required QUERYtext Yes OUTPUT_FILEtext Yes
Flag Type Required Default Description --earliesttext No — Earliest time for search --latesttext No — Latest time for search --output-modechoice No jsonOutput format Choices: json, xml, csv --hosttext No — Splunk server hostname (overrides config) --portinteger No — Splunk management port (overrides config) --usernametext No — Username (overrides config) --passwordtext No — Password (overrides config); prefer SPLUNK_PASSWORD or init.yaml over this flag
Export search results with format and compression options.
Shell
regscale splunk export-advanced [OPTIONS]
Argument Type Required QUERYtext Yes OUTPUT_PATHpath Yes
Flag Type Required Default Description --formatchoice No jsonOutput format. Choices: json, csv, tsv, xml, raw, pickle --compressionchoice No noneCompression applied to the output. Choices: none, gzip, bzip2, lzma --chunk-sizeinteger No 10000Records per output file. --earliesttext No — Earliest time for search --latesttext No — Latest time for search --hosttext No — Splunk server hostname (overrides config) --portinteger No — Splunk management port (overrides config) --usernametext No — Username (overrides config) --passwordtext No — Password (overrides config); prefer SPLUNK_PASSWORD or init.yaml over this flag
Fetch raw events from one or more existing Splunk jobs by SID.
Shell
regscale splunk get-job-events [OPTIONS]
Argument Type Required SIDStext Yes
Flag Type Required Default Description --max-eventsinteger No 100Maximum events to display per job --hosttext No — Splunk server hostname (overrides config) --portinteger No — Splunk management port (overrides config) --usernametext No — Username (overrides config) --passwordtext No — Password (overrides config); prefer SPLUNK_PASSWORD or init.yaml over this flag --save_output_todirectory No — Provide the path where you would like to save the output to.
Fetch processed results from one or more existing Splunk jobs by SID.
Shell
regscale splunk get-job-results [OPTIONS]
Argument Type Required SIDStext Yes
Flag Type Required Default Description --max-resultsinteger No 100Maximum results to display per job --page-sizeinteger No 1000Page size for paginated retrieval --hosttext No — Splunk server hostname (overrides config) --portinteger No — Splunk management port (overrides config) --usernametext No — Username (overrides config) --passwordtext No — Password (overrides config); prefer SPLUNK_PASSWORD or init.yaml over this flag --save_output_todirectory No — Provide the path where you would like to save the output to.
Create RegScale Evidence (linked to controls) from Splunk saved-search results.
Shell
regscale splunk ingest-evidence [OPTIONS]
Flag Type Required Default Description --regscale_ssp_id, -id, --id, --regscale_idinteger Yes — The ID number from RegScale of the System Security Plan --regscale_module, -mchoice No securityplansEnter the RegScale module name. RegScale Module Accepted Value Assessment | assessments Asset | assets Case | cases Catalogue | catalogues Causal Analysis | causalanalysis Control Objective | controlobjectives Component | components Data Call | datacalls Exception | exceptions Incident | incidents Interconnect | interconnects Issue(POAM) | issues Policy | policies Project | projects Questionnaire | questionnaires Requirement | requirements Risk | risks Security Control | securitycontrols Security Control Implementation | controls Security Plan | securityplans Security Profile | profiles Supply Chain(Contract) | supplychain Task | tasks Threat | threats Choices: assessments, assets, cases, catalogues, causalanalysis, controlobjectives, components, datacalls, exceptions, incidents, interconnects, issues, policies, projects, questionnaires, requirements, risks, securitycontrols, controls, securityplans, profiles, supplychain, tasks, threats --saved-searchtext No — Splunk saved-search name to dispatch and ingest. Repeatable. Defaults to the splunkEvidenceSavedSearches init.yaml setting. --from-dirpath No — Offline/backfill mode: directory holding exported .json result files. --source-listpath No — Offline/backfill mode: file listing one source key per line (used with --from-dir). --skipped-reportpath No — Markdown file for skipped-source review entries. Defaults under splunkOutputDir. --dry-run, --no-dry-runboolean No truePreview what would be created without writing. --hosttext No — Splunk server hostname (overrides config) --portinteger No — Splunk management port (overrides config) --usernametext No — Username (overrides config) --passwordtext No — Password (overrides config); prefer SPLUNK_PASSWORD or init.yaml over this flag
List all Splunk search jobs visible to the authenticated user.
Shell
regscale splunk list-jobs [OPTIONS]
Flag Type Required Default Description --hosttext No — Splunk server hostname (overrides config) --portinteger No — Splunk management port (overrides config) --usernametext No — Username (overrides config) --passwordtext No — Password (overrides config); prefer SPLUNK_PASSWORD or init.yaml over this flag --save_output_todirectory No — Provide the path where you would like to save the output to.
Process Splunk search results into RegScale assets and findings.
Shell
regscale splunk process [OPTIONS]
Argument Type Required QUERYtext Yes
Flag Type Required Default Description --earliesttext No — Earliest time for search --latesttext No — Latest time for search --create-assets, --no-create-assetsboolean No trueCreate assets from results --create-findings, --no-create-findingsboolean No trueCreate findings from results --regscale_ssp_id, -id, --id, --regscale_idinteger Yes — The ID number from RegScale of the System Security Plan --regscale_module, -mchoice No securityplansEnter the RegScale module name. RegScale Module Accepted Value Assessment | assessments Asset | assets Case | cases Catalogue | catalogues Causal Analysis | causalanalysis Control Objective | controlobjectives Component | components Data Call | datacalls Exception | exceptions Incident | incidents Interconnect | interconnects Issue(POAM) | issues Policy | policies Project | projects Questionnaire | questionnaires Requirement | requirements Risk | risks Security Control | securitycontrols Security Control Implementation | controls Security Plan | securityplans Security Profile | profiles Supply Chain(Contract) | supplychain Task | tasks Threat | threats Choices: assessments, assets, cases, catalogues, causalanalysis, controlobjectives, components, datacalls, exceptions, incidents, interconnects, issues, policies, projects, questionnaires, requirements, risks, securitycontrols, controls, securityplans, profiles, supplychain, tasks, threats --tagstext No — Comma-separated tags to apply to assets/findings --export-jsontext No — Export results to JSON file --export-csv-assetstext No — Export assets to CSV file --export-csv-findingstext No — Export findings to CSV file --hosttext No — Splunk server hostname (overrides config) --portinteger No — Splunk management port (overrides config) --usernametext No — Username (overrides config) --passwordtext No — Password (overrides config); prefer SPLUNK_PASSWORD or init.yaml over this flag
Run a saved search by name.
Shell
regscale splunk run-saved [OPTIONS]
Argument Type Required SEARCH_NAMEtext Yes
Flag Type Required Default Description --hosttext No — Splunk server hostname (overrides config) --portinteger No — Splunk management port (overrides config) --usernametext No — Username (overrides config) --passwordtext No — Password (overrides config); prefer SPLUNK_PASSWORD or init.yaml over this flag --save_output_todirectory No — Provide the path where you would like to save the output to.
List saved searches.
Shell
regscale splunk saved-searches [OPTIONS]
Flag Type Required Default Description --hosttext No — Splunk server hostname (overrides config) --portinteger No — Splunk management port (overrides config) --usernametext No — Username (overrides config) --passwordtext No — Password (overrides config); prefer SPLUNK_PASSWORD or init.yaml over this flag --save_output_todirectory No — Provide the path where you would like to save the output to.
Execute SPL search query.
Shell
regscale splunk search [OPTIONS]
Argument Type Required QUERYtext Yes
Flag Type Required Default Description --earliesttext No — Earliest time for search (e.g., '-24h', '2023-01-01T00:00:00') --latesttext No — Latest time for search (e.g., 'now', '2023-01-02T00:00:00') --output-modechoice No jsonOutput format Choices: json, xml, csv --max-resultsinteger No — Maximum number of results --hosttext No — Splunk server hostname (overrides config) --portinteger No — Splunk management port (overrides config) --usernametext No — Username (overrides config) --passwordtext No — Password (overrides config); prefer SPLUNK_PASSWORD or init.yaml over this flag --save_output_todirectory No — Provide the path where you would like to save the output to.
Run the configured Splunk saved searches and import the results into RegScale.
Shell
regscale splunk sync [OPTIONS]
Flag Type Required Default Description --regscale_id, -id, --idinteger Yes — Enter the desired ID # from RegScale. --regscale_module, -mchoice No securityplansEnter the RegScale module name. RegScale Module Accepted Value Assessment | assessments Asset | assets Case | cases Catalogue | catalogues Causal Analysis | causalanalysis Control Objective | controlobjectives Component | components Data Call | datacalls Exception | exceptions Incident | incidents Interconnect | interconnects Issue(POAM) | issues Policy | policies Project | projects Questionnaire | questionnaires Requirement | requirements Risk | risks Security Control | securitycontrols Security Control Implementation | controls Security Plan | securityplans Security Profile | profiles Supply Chain(Contract) | supplychain Task | tasks Threat | threats Choices: assessments, assets, cases, catalogues, causalanalysis, controlobjectives, components, datacalls, exceptions, incidents, interconnects, issues, policies, projects, questionnaires, requirements, risks, securitycontrols, controls, securityplans, profiles, supplychain, tasks, threats --saved-searchtext No — Saved-search name to run. Repeatable. Overrides the splunkSavedSearches setting. --create-assets, --no-create-assetsboolean No trueImport assets --create-findings, --no-create-findingsboolean No trueImport findings --create-evidence, --no-create-evidenceboolean No falseImport control evidence (requires control_id and control_evidence fields in the results) --create-data, --no-create-databoolean No trueImport Data records --dry-run, --no-dry-runboolean No falseEvidence only: preview without writing. Assets and findings always write. --hosttext No — Splunk server hostname (overrides config) --portinteger No — Splunk management port (overrides config) --usernametext No — Username (overrides config) --passwordtext No — Password (overrides config); prefer SPLUNK_PASSWORD or init.yaml over this flag
Test connection to Splunk server.
Shell
regscale splunk test-connection [OPTIONS]
Flag Type Required Default Description --hosttext No — Splunk server hostname (overrides config) --portinteger No — Splunk management port (overrides config) --usernametext No — Username (overrides config) --passwordtext No — Password (overrides config); prefer SPLUNK_PASSWORD or init.yaml over this flag --schemechoice No — Connection scheme (overrides config) Choices: http, https --ssl-verify, --no-ssl-verifyboolean No — Verify SSL certificates
Upload a file into Splunk via HTTP Event Collector.
Shell
regscale splunk upload-hec [OPTIONS]
Argument Type Required INPUT_FILEfile Yes
Flag Type Required Default Description --formatchoice No — Input format. Inferred from the file extension when omitted. Choices: json, csv, raw --indextext No — Target Splunk index (overrides splunkHecIndex) --sourcetext No — Event source value (overrides splunkHecSource) --sourcetypetext No — Event sourcetype value (overrides splunkHecSourcetype) --host-fieldtext No — Event host value --whole-file, --line-by-lineboolean No falseFor raw format: send the file as one event instead of one event per line.
