---
title: "Update a Splunk integration."
method: PUT
path: "/v1/integrations/splunk/{id}"
tags: ["Splunk Integration"]
---

# Update a Splunk integration.

`PUT /v1/integrations/splunk/{id}`

## Request

- Base URL: `https://docs.grepr.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.grepr.ai/v1/integrations/splunk/{id}`
- Auth: OpenID Connect (`https://grepr-prod.us.auth0.com/.well-known/openid-configuration`)

Updates an integration to connect to Splunk. The version should be increased by one for every new update in order for the write to succeed. Otherwise, a '409 Conflict' will be returned.

## Path parameters

- `id` string, required

## Request body

- WriteSplunk
  - `name` string, required: Name of the integration.
  - `payload` Splunk, required: The payload containing integration data.
    - `additionalTags` string[], required: Tags to add when writing data to Splunk
    - `authToken` string: Masked HEC REST Auth token for Splunk used for ingestion
    - `exceptions` object: The imported exceptions from Splunk. This is a map from the vendor resource Id to the exception.
    - `filterQuery` string, required: Filter to apply when reading any data from the Splunk API
    - `ingestHost` string: Splunk ingest host name or IP address for log ingestion by the sinkfor both HTTP Event Collector (HEC) and Splunk-to-Splunk (S2S) ingestion.Either of splunk host or this should be specified.
    - `ingestPort` string: Splunk ingest port
    - `restAuthToken` string: Masked Splunk REST Auth token for Splunk used for search
    - `restHost` string: Splunk REST API host name or IP address for splunk logs and alerts search.Either of splunk host or this should be specified.
    - `restPort` string: Splunk REST port
    - `secure` boolean: Splunk collector uses a valid SSL certificate
    - `splunkHost` string: Splunk host name or IP address. If specified, ingest, REST and web endpoints default to this host. Either of splunk host or advanced config with individual endpoints should be specified.
    - `webHost` string: Splunk web host name or IP address for linking to Splunk Web UI to view backfilled logsEither of splunk host or this should be specified.
    - `webPort` string: Splunk web port
  - `teamIds` string[]: The team IDs that this integration is associated with.
  - `type` 'splunk', required: The type of the integration. This is used to determine the payload type.
  - `version` integer, required: Version of the integration. Should be increased by one for every new update in order for the write to succeed. Otherwise, a '409 Conflict' will be returned.

## Response `200`

Integration updated successfully

- ReadSplunk
  - `createdAt` string, date-time, required: Timestamp when the integration was created.
  - `id` string, required: The integration id
  - `jobIds` string[], required: List of job IDs associated with the integration.
  - `name` string, required: Name of the integration.
  - `organizationId` string, required: Organization ID of the integration.
  - `payload` Splunk, required: The payload containing integration data.
    - `additionalTags` string[], required: Tags to add when writing data to Splunk
    - `authToken` string: Masked HEC REST Auth token for Splunk used for ingestion
    - `exceptions` object: The imported exceptions from Splunk. This is a map from the vendor resource Id to the exception.
    - `filterQuery` string, required: Filter to apply when reading any data from the Splunk API
    - `ingestHost` string: Splunk ingest host name or IP address for log ingestion by the sinkfor both HTTP Event Collector (HEC) and Splunk-to-Splunk (S2S) ingestion.Either of splunk host or this should be specified.
    - `ingestPort` string: Splunk ingest port
    - `restAuthToken` string: Masked Splunk REST Auth token for Splunk used for search
    - `restHost` string: Splunk REST API host name or IP address for splunk logs and alerts search.Either of splunk host or this should be specified.
    - `restPort` string: Splunk REST port
    - `secure` boolean: Splunk collector uses a valid SSL certificate
    - `splunkHost` string: Splunk host name or IP address. If specified, ingest, REST and web endpoints default to this host. Either of splunk host or advanced config with individual endpoints should be specified.
    - `webHost` string: Splunk web host name or IP address for linking to Splunk Web UI to view backfilled logsEither of splunk host or this should be specified.
    - `webPort` string: Splunk web port
  - `teamIds` string[]: The team IDs that this integration is associated with.
  - `type` 'splunk', required: The type of the integration. This is used to determine the payload type.
  - `updatedAt` string, date-time, required: Timestamp when the integration was last updated.
  - `version` integer, required: Version of the integration. Should be increased by one for every new update in order for the write to succeed. Otherwise, a '409 Conflict' will be returned.

## Other responses

- `401`: Unauthorized
- `404`: Integration not found.
- `409`: Integration was modified or deleted concurrently.

---

[API](https://skmtc.dev/grepr/apis/grepr-api.md) - [All operations](https://skmtc.dev/grepr/apis/grepr-api/llms.txt) - [OpenAPI document](https://skmtc.dev/grepr/apis/grepr-api/revisions/2a5ce03a0bf0?raw)