Data Punctum Documentation

S3SPL is an add-on for Splunk that enables immediate insight into data stored in S3 using custom Splunk commands. It works with any data source stored in S3 that can be queried using S3 Select, including JSON, CSV, Parquet, and files generated by Splunk Ingest Actions. Key capabilities include:

• Ad-hoc querying of S3 using WHERE statements via S3 Select.
• Saving and sharing queries with other users.
• Automatic timestamp management based on defined field names.
• Dynamic query adaptation using replacements.
• An interactive workbench for creating and previewing queries.
• Administrative management of multiple buckets and saved queries.
• Granular access control to buckets and prefixes based on Splunk capabilities and roles.

ElasticSPL allows Splunk users to query data stored in Elasticsearch using custom Splunk commands. Key capabilities include:

• Ad-hoc querying of time-series data using DSL, Lucene, or ES|QL via elasticadhoc and elasticquery commands.
• Ad-hoc querying of aggregated data via elasticadhocstats and elasticquerystats commands.
• Saving and sharing DSL, Lucene, or ES|QL queries.
• Automatic timestamp management based on defined field names.
• Dynamic query adaptation using replacements in DSL or Lucene queries.
• An interactive explorer dashboard for creating and previewing DSL or Lucene queries.
• Administrative management of multiple Elasticsearch instances and saved queries with granular access control based on Splunk roles and capabilities.

The elasticadhoc command is used to query Elasticsearch using DSL, Lucene, or ES|QL syntax. It is recommended for testing queries or performing quick checks. For repeated queries, elasticquery is preferred due to the complexity and readability of the elasticadhoc syntax.

Supported query syntaxes include:

• Elasticsearch Query DSL
• Apache Lucene
• Elasticsearch ES|QL

To update a saved query, you must have the s3spl_power role and be a member of one of the query's writing groups.

1. Select the query to update from the Query dropdown.
2. Select the target bucket from the Bucket dropdown.
3. Modify the input fields in the sidebar as needed.
4. Click the Update button to open the Update Query modal.
5. Click Update to save the changes.

To execute a query via s3splquery, a user must meet two permission requirements:

1. Query Permissions: The user must have 'read' permissions assigned to the specific saved query.
2. Command Permissions: The user must have execution permissions for the command, which is provided by the s3spl_user role.

S3SPL utilizes Splunk's access control mechanisms to manage permissions at the knowledge object level (buckets and queries) rather than the user level.

Each knowledge object maintains two lists:

1. Roles allowed to access (read) the object.
2. Roles allowed to edit (write) the object.

Note: The owner of a knowledge object always retains full access and editing privileges, regardless of whether they are members of a role that provides write access.