salt.states.splunk_search

Splunk Search State Module

This state is used to ensure presence of splunk searches.

server-warning-message:
  splunk_search.present:
    - name: This is the splunk search name
    - search: index=main sourcetype=

salt.states.splunk_search.absent(name, profile='splunk')

Ensure a search is absent

API Error Search:
  splunk_search.absent

The following parameters are required:

name

This is the name of the search in splunk

salt.states.splunk_search.present(name, profile='splunk', **kwargs)

Ensure a search is present

API Error Search:
  splunk_search.present:
    search: index=main sourcetype=blah
    template: alert_5min

The following parameters are required:

name

This is the name of the search in splunk