# Notable Events

Fetches notable events from Splunk Enterprise Security for threat detection and incident tracking.

**Sync Type: Incremental Synchronisation**

## Requirements

Before configuring this input, you need to:

1. **Have Splunk Enterprise Security (ES) installed** — The `notable` index is created by Splunk Enterprise Security. If you do not have ES installed, this input will not be able to retrieve events.
    - Verify ES is installed by checking if the `notable` index exists in your Splunk instance

2. **Create a Bearer Token** — [Splunk Bearer Token docs](https://docs.splunk.com/Documentation/Splunk/latest/Admin/TokenAuthentication).
    - Log in to Splunk Web
    - Navigate to **Settings → Tokens**
    - Click **New Token** (or **Create new token**)
    - Provide a name and optional description
    - Click **Create** and copy the generated token
    - Securely store the token

3. **Ensure REST API port is reachable** — The default REST API port is 8089. Verify that this port (or your configured port) is reachable from your Monad collector.
    - If using a custom port, note it for configuration

## Details

Monad retrieves new notable events from Splunk Enterprise using incremental synchronisation. The input tracks the latest event timestamp (`_time`) from each sync run and on the next run, retrieves only events with newer timestamps.

### Data Retrieval Flow

1. Creates a Splunk search job via `POST /services/search/jobs` with the Splunk Processing Language (SPL) query `search index=notable | sort 0 _time`
   - On subsequent runs, the query becomes `search index=notable _time>{epoch} | sort 0 _time` to retrieve only newer events
2. Stores the search job SID in state immediately after creation to enable resumption if interrupted
3. Polls `GET /services/search/jobs/{sid}` every 10 seconds until the search completes (timeout: 5 minutes)
4. Retrieves paginated results via `GET /services/search/jobs/{sid}/results` with 1000 records per page
5. After each page, checkpoints the latest `_time` epoch value so the next run only fetches newer events
6. Deletes the search job via `DELETE /services/search/jobs/{sid}` after all results are streamed
7. On restart: If a SID is stored in state, resumes polling and streaming that job instead of creating a new one

## Configuration

The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.

### Settings

| Setting | Type | Required | Description |
|---------|------|----------|-------------|
| Host | string | Yes | Splunk hostname or IP address without scheme (e.g., `splunk.example.com` or `localhost`). Do not include `http://` or `https://`. |
| Port | integer | No | Splunk REST API port. Defaults to `8089` if not specified. |
| Cron | string | Yes | Schedule for running the input as a standard cron expression (e.g., `0 */6 * * *` for every 6 hours). |
| Use Synthetic Data | boolean | No | Generate synthetic demo data instead of connecting to the real data source. Defaults to false. |
| API Rate Limit | object | No | Optional limit on the connector's outbound request rate to the source API. Leave blank to use the connector's default behavior. See [API Rate Limiting](../../../guides/rate-limiting) for the field format, limits, and how to choose a value. |

### Secrets

| Secret | Type | Required | Description |
|--------|------|----------|-------------|
| Token | string | Yes | Splunk Bearer token used for authenticating REST API requests. Sent as the `Authorization: Bearer <token>` header. |

## Rate Limits

| Scope | Limit | Window | Notes |
|-------|-------|--------|-------|
| API Requests | 10 | Per second | Conservative limit; Splunk Enterprise does not publicly document exact REST API rate limits |

**Source**: Internal rate limit configuration for reliability

## Limitations

- Requires Splunk Enterprise Security (ES) to be installed
- Search job polling timeout is 5 minutes; very large result sets may require longer windows

## Related Articles

- [Splunk Enterprise Create Search API](https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.2/search-endpoints/search-endpoint-descriptions#post-12)
- [Splunk Enterprise Fetch Results API](https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.2/search-endpoints/search-endpoint-descriptions#get-22)
- [Splunk Enterprise Security Documentation](https://docs.splunk.com/Documentation/ES/latest/User/Introduction)