Kestra Add-on for Splunk

The Kestra Add-on for Splunk turns Splunk alerts into automated workflows. It adds a "Trigger Kestra Flow" alert action that starts an execution of any Kestra flow whenever a Splunk alert fires, so detections lead directly to remediation, ticketing, notifications, data pipelines or any other process orchestrated in Kestra. Problem it solves: Splunk is good at detecting that something happened, but responding usually means custom scripts, webhooks with no authentication, or manual hand-offs. This add-on connects Splunk to Kestra natively and securely: the alert's metadata, selected result fields, and the full search results file are sent to the flow as typed inputs through the Kestra Executions API. Key features: - "Trigger Kestra Flow" alert action, configured per alert (tenant, namespace, flow ID) - Reusable Kestra connections; API tokens are stored encrypted in Splunk's credential store - Full search results attached as a CSV file input - Alert metadata forwarded as flow inputs (search name, SID, app, owner, trigger time, results link) - Flexible input mapping from Splunk tokens such as $result.field$ and $name$ to flow inputs - Role for non-admin alert owners (kestra_alert_user)