{
  "packaging_version": "2",
  "type": "splunk",
  "name": "Splunk",
  "version": "1.0.0",
  "min_app_version": "0.1.0",
  "description": "Query Splunk REST API for security event visibility",
  "category": "SIEM / Log Management",
  "icon": "search",
  "supported_modes": ["batch"],
  "implementation": {
    "type": "container",
    "image": "ghcr.io/silentpulse/connector-splunk:1.0.0",
    "resources": { "cpu": "100m", "memory": "256Mi" },
    "scaling": { "min_replicas": 1, "max_replicas": 4 },
    "health_check": { "command": ["/connector", "--healthcheck"], "interval": 30, "timeout": 5 },
    "build": { "repository": "https://github.com/silentpulse/connectors" }
  },
  "fields": [
    { "name": "base_url", "type": "url", "required": true, "group": "connection", "label": "Base URL", "description": "Splunk management API endpoint" },
    { "name": "token", "type": "password", "required": false, "group": "connection", "label": "Bearer Token", "description": "Splunk Bearer token" },
    { "name": "username", "type": "text", "required": false, "group": "connection", "label": "Username" },
    { "name": "password", "type": "password", "required": false, "group": "connection", "label": "Password" },
    { "name": "skip_tls_verify", "type": "boolean", "required": false, "group": "connection", "label": "Skip TLS Verify" },
    { "name": "search_query", "type": "textarea", "required": true, "group": "query", "label": "Search Query", "description": "Splunk SPL search query" },
    { "name": "index", "type": "text", "required": false, "group": "query", "label": "Index", "default": "main" },
    { "name": "hostname_field", "type": "text", "required": true, "group": "query", "label": "Hostname Field", "default": "host" },
    { "name": "time_window", "type": "text", "required": false, "group": "query", "label": "Time Window", "default": "15m" }
  ],
  "maintainer": {
    "name": "SilentPulse",
    "email": "support@silentpulse.io",
    "url": "https://silentpulse.io"
  },
  "repository": "https://github.com/silentpulse/connectors",
  "tags": ["siem", "splunk", "log-management", "search"],
  "readme": "# Splunk Connector\n\nQuery Splunk REST API to detect which assets are actively sending security events.\n\n## Requirements\n\n- Splunk Enterprise or Splunk Cloud\n- REST API access (port 8089 for on-prem)\n- Bearer token or username/password credentials\n\n## Configuration\n\nProvide the Splunk management URL and authentication credentials. Write an SPL query that returns events containing hostname information.\n\n## Authentication\n\nSupports both Bearer token and basic (username/password) authentication. Token auth is recommended for production.",
  "notes": {
    "requirements": "Splunk Enterprise 8.0+ or Splunk Cloud with REST API access",
    "configuration": "Provide base URL, credentials, and SPL query. Token auth recommended.",
    "limitations": "Search jobs are limited by Splunk license quotas. Large time windows may timeout."
  }
}