Splunk Supporting Add-on for Elasticsearch (ElasticSPL) provides a straightforward way of querying data stored in Elasticsearch from Splunk using custom Splunk commands.

ElasticSPL provides the following functionality to Splunk users:

Query Elasticsearch in an ad-hoc fashion using DSL or Lucene search statements for time-series data using elasticadhoc and elasticquery
Query Elasticsearch in an ad-hoc fashion using DSL search statements for aggregated data using elasticadhocstats and elasticquerystats
Save DSL or Lucene queries and share them with other users
Configure DSL or Lucene queries to manage timestamps based on defined field names automatically
Configure DSL or Lucene queries with replacements to adapt queries to the current requirement on the fly
Create DSL or Lucene queries and preview results using an interactive explorer dashboard

In addition, ElasticSPL provides an admin section that allows the management of multiple Elasticsearch instances and saved queries. Finally, a comprehensive access control system based on Splunk capabilities and roles allows for granular access control from Splunk to Elasticsearch.

ElasticSPL is compatible with the following flavours of Elasticsearch:
- Elasticsearch 8
- Elasticsearch 7
- Elasticsearch 6
- OpenDistro
- OpenSearch

Keywords: Elasticsearch, Elastic, OpenDistro, OpenSearch, ELK, Kibana