Splunk Driver class.


Bases: DriverBase

Driver to connect and query from Splunk.

Instantiate Splunk Driver.

add_query_filter(name: str, query_filter: str | Iterable)

Add an expression to the query attach filter.

connect(connection_str: str | None = None, **kwargs)

Connect to Splunk via splunk-sdk.

  • connection_str (Optional[str], optional) – Connection string with Splunk connection parameters

  • kwargs – Connection parameters can be supplied as keyword parameters.


Default configuration is read from the DataProviders/Splunk section of msticpyconfig.yaml, if available.

property connected: bool

Return true if at least one connection has been made.


True if a successful connection has been made.

Return type:



This does not guarantee that the last data source connection was successful. It is a best effort to track whether the provider has made at least one successful authentication.

property driver_queries: Iterable[Dict[str, Any]]

Return dynamic queries available on connection to service.


List of queries with properties: “name”, “query”, “container” and (optionally) “description”

Return type:

Iterable[Dict[str, Any]]


MsticpyNotConnectedError – If called before driver is connected.

get_driver_property(name: str) Any

Return value or KeyError from driver properties.

static get_http_timeout(**kwargs)

Get http timeout from settings or kwargs.

property instance: str | None

Return instance name, if one is set.


The name of driver instance or None if the driver does not support multiple instances

Return type:


property loaded: bool

Return true if the provider is loaded.


True if the provider is loaded.

Return type:



This is not relevant for some providers.

query(query: str, query_source: QuerySource | None = None, **kwargs) DataFrame | Any

Execute splunk query and retrieve results via OneShot or async search mode.

  • query (str) – Splunk query to execute via OneShot or async search mode

  • query_source (QuerySource) – The query definition object

  • count (int, optional) – Passed to Splunk job that indicates the maximum number of entities to return. A value of 0 indicates no maximum, by default, 0

  • oneshot (bool, optional) – Set to True for oneshot (blocking) mode, by default False

  • int (page_size =) – Pass to Splunk results reader in terms of fetch speed, which sets of result amount will be got at a time, by default, 100

  • optional – Pass to Splunk results reader in terms of fetch speed, which sets of result amount will be got at a time, by default, 100

  • timeout (int, optional) – Amount of time to wait for results, by default 60


Query results in a dataframe. or query response if an error.

Return type:

Union[pd.DataFrame, Any]

property query_attach_spec: Dict[str, Set[str]]

Parameters that determine whether a query is relevant for the driver.

query_usable(query_source: QuerySource) bool

Return True if query should be exposed for this driver.

query_with_results(query: str, **kwargs) Tuple[DataFrame, Any]

Execute query string and return DataFrame of results.


query (str) – Query to execute against splunk instance.


A DataFrame (if successful) or the underlying provider result if an error occurs.

Return type:


property schema: Dict[str, Dict]

Return current data schema of connection.


Data schema of current connection.

Return type:

Dict[str, Dict]

property service_queries: Tuple[Dict[str, str], str]

Return dynamic queries available on connection to service.


Dictionary of query_name, query_text. Name of container to add queries to.

Return type:

Tuple[Dict[str, str], str]

set_driver_property(name: str, value: Any)

Set an item in driver properties.