---
title: "List all Splunk integrations"
method: GET
path: "/v1/integrations/splunk"
tags: ["Splunk Integration"]
---

# List all Splunk integrations

`GET /v1/integrations/splunk`

## Request

- Base URL: `https://docs.grepr.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.grepr.ai/v1/integrations/splunk`
- Auth: OpenID Connect (`https://grepr-prod.us.auth0.com/.well-known/openid-configuration`)

Get all Splunk integrations for your organization. This will contain masked keys if present.

## Response `200`

Integrations retrieved successfully

- ItemsCollectionReadSplunk
  - `items` ReadSplunk[]
    - `createdAt` string, date-time, required: Timestamp when the integration was created.
    - `id` string, required: The integration id
    - `jobIds` string[], required: List of job IDs associated with the integration.
    - `name` string, required: Name of the integration.
    - `organizationId` string, required: Organization ID of the integration.
    - `payload` Splunk, required: The payload containing integration data.
      - `additionalTags` string[], required: Tags to add when writing data to Splunk
      - `authToken` string: Masked HEC REST Auth token for Splunk used for ingestion
      - `exceptions` object: The imported exceptions from Splunk. This is a map from the vendor resource Id to the exception.
      - `filterQuery` string, required: Filter to apply when reading any data from the Splunk API
      - `ingestHost` string: Splunk ingest host name or IP address for log ingestion by the sinkfor both HTTP Event Collector (HEC) and Splunk-to-Splunk (S2S) ingestion.Either of splunk host or this should be specified.
      - `ingestPort` string: Splunk ingest port
      - `restAuthToken` string: Masked Splunk REST Auth token for Splunk used for search
      - `restHost` string: Splunk REST API host name or IP address for splunk logs and alerts search.Either of splunk host or this should be specified.
      - `restPort` string: Splunk REST port
      - `secure` boolean: Splunk collector uses a valid SSL certificate
      - `splunkHost` string: Splunk host name or IP address. If specified, ingest, REST and web endpoints default to this host. Either of splunk host or advanced config with individual endpoints should be specified.
      - `webHost` string: Splunk web host name or IP address for linking to Splunk Web UI to view backfilled logsEither of splunk host or this should be specified.
      - `webPort` string: Splunk web port
    - `teamIds` string[]: The team IDs that this integration is associated with.
    - `type` 'splunk', required: The type of the integration. This is used to determine the payload type.
    - `updatedAt` string, date-time, required: Timestamp when the integration was last updated.
    - `version` integer, required: Version of the integration. Should be increased by one for every new update in order for the write to succeed. Otherwise, a '409 Conflict' will be returned.

## Other responses

- `401`: Unauthorized

---

[API](https://skmtc.dev/grepr/apis/grepr-api.md) - [All operations](https://skmtc.dev/grepr/apis/grepr-api/llms.txt) - [OpenAPI document](https://skmtc.dev/grepr/apis/grepr-api/revisions/2a5ce03a0bf0?raw)