Overview

Details

Datapunctum ElasticSPL enables Splunk users to query data stored in Elasticsearch without switching tools. The comprehensive feature set supports both time-series and aggregated DSL queries and provides a powerful, intuitive interface for exploring data.

See Documentation at [docs.datapunctum.com/elasticspl](https://docs.datapunctum.com/elasticspl)

Keywords: Elasticsearch, Elastic, OpenDistro, OpenSearch, ELK, Kibana

Splunk Supporting Add-on for Elasticsearch (ElasticSPL) provides a straightforward way of querying data stored in Elasticsearch from Splunk using custom Splunk commands.

ElasticSPL provides the following functionality to Splunk users:

Query Elasticsearch in an ad-hoc fashion using DSL or Lucene search statements for time-series data using elasticadhoc and elasticquery
Query Elasticsearch in an ad-hoc fashion using DSL search statements for aggregated data using elasticadhocstats and elasticquerystats
Save DSL or Lucene queries and share them with other users
Configure DSL or Lucene queries to manage timestamps based on defined field names automatically
Configure DSL or Lucene queries with replacements to adapt queries to the current requirement on the fly
Create DSL or Lucene queries and preview results using an interactive explorer dashboard

In addition, ElasticSPL provides an admin section that allows the management of multiple Elasticsearch instances and saved queries. Finally, a comprehensive access control system based on Splunk capabilities and roles allows for granular access control from Splunk to Elasticsearch.

ElasticSPL is compatible with the following flavours of Elasticsearch:
- Elasticsearch 8
- Elasticsearch 7
- Elasticsearch 6
- OpenDistro
- OpenSearch

Keywords: Elasticsearch, Elastic, OpenDistro, OpenSearch, ELK, Kibana

Release Notes

Version 1.3.0

Sept. 5, 2024

New Features

ES|QL Support
Mutlti-Line Queries

Version 1.2.3

April 25, 2024

Fixed issues:

ElasticSPL-33 Windows specific .pyd file missing

Version 1.2.2

Feb. 6, 2024

Fixed issues:

ElasticSPL-26 Eventbreaking broken for internal logs
ElasticSPL-32 Update frontend packages

Version 1.2.1

July 25, 2023

Fixed Bugs

Fixed issue with Elasticsearch context not being removed after use
Fixed process leak on Splunk killing search command (on search termination)
Improved error passing from worker process to Splunk

Version 1.2.0

June 26, 2023

Overall Improvements

Implemented Splunk-like permission model
-Implemented update framework for future updates

Workbench Improvements

Improved workbench performance
Added table, raw, and visualization view
-Allowing for full queries by leveraging the Splunk Search API
Added support for post-processing commands

Fixed Bugs

Switching between Basic Authentication and API Key Authentication breaks the instance configuration

Upgrade Notes

Please see Upgrade Notes for more details.

916

Downloads

Share Subscribe

Version

Built by

Datapunctum AG

Support

Developer Supported

Contact Developer Questions on Splunk Answers Flag as inappropriate

App Contents: Inputs

Compatibility

This version of the app (1.2.3) is not available for Splunk Cloud. However, version 1.3.0 of this app is available for Splunk Cloud.

This version of the app (1.2.2) is not available for Splunk Cloud. However, version 1.3.0 of this app is available for Splunk Cloud.

This version of the app (1.2.1) is not available for Splunk Cloud. However, version 1.3.0 of this app is available for Splunk Cloud.

This version of the app (1.2.0) is not available for Splunk Cloud. However, version 1.3.0 of this app is available for Splunk Cloud.

Products: Splunk Cloud

Splunk Versions: 9.4, 9.3, 9.2, 9.1, 9.0