Complete guide to all 14 SPL commands
TA-webtools-pro adds 14 custom search commands to Splunk. After installation, you can use these commands directly in your searches without any additional configuration.
curl | dig | ping | trace | telnet
openssl | letsencrypt
scp | sftp | ftp | file
whois | speedtest | urlencode
Make HTTP requests with full control over method, headers, and authentication.
| Parameter | Description | Required |
|---|---|---|
uri | Target URL | Yes |
method | GET, POST, PUT, DELETE, PATCH (default: GET) | No |
data | Request body content | No |
headers | Custom HTTP headers as JSON | No |
token | Bearer token for authentication | No |
timeout | Request timeout in seconds (default: 30) | No |
# GET request
| curl uri=https://api.example.com/data | table curl_status, curl_message
# POST with JSON
| makeresults | eval data="{\"name\":\"test\"}" | curl method=post uri=https://api.example.com/endpoint datafield=data
Perform hashing, encryption, key generation, and TLS certificate validation.
| Parameter | Description | Required |
|---|---|---|
mode | digest, hmac, encrypt, decrypt, genkey, tls_cert, verify | Yes |
algorithm | sha256, sha512, md5, etc. | No |
inputfield | Field containing input data | No |
key | Encryption key or passphrase | No |
host | Host for TLS certificate check | No |
# SHA256 hash
| makeresults | eval data="Hello World" | openssl mode=digest algorithm=sha256 inputfield=data | table digest
# Check TLS certificate
| openssl mode=tls_cert host=example.com port=443 | table subject, notAfter, valid
Query DNS records for domains and IP addresses.
| Parameter | Description | Required |
|---|---|---|
domain | Domain name to query | Yes* |
domainfield | Field containing domain name | Yes* |
type | A, AAAA, MX, NS, TXT, CNAME, PTR (default: A) | No |
ns | Custom DNS server | No |
# A record lookup
| dig domain=google.com | table domain, answers_json
# MX records
| dig domain=example.com type=MX | table answers_json
# Reverse DNS
| dig ip=8.8.8.8 | table answers_json
Test host reachability and measure latency.
| Parameter | Description | Required |
|---|---|---|
host | Target hostname or IP | Yes |
count | Number of ping packets (default: 4) | No |
timeout | Timeout per packet in seconds (default: 2) | No |
# Basic ping
| ping host=google.com | table host, packet_loss_percent, rtt_avg
# Extended ping
| ping host=8.8.8.8 count=10 | table packets_transmitted, packet_loss_percent, rtt_avg
Trace the network route to a target host.
| Parameter | Description | Required |
|---|---|---|
host | Target hostname or IP | Yes |
max_hops | Maximum hops to trace (default: 30) | No |
timeout | Timeout per hop in seconds (default: 2) | No |
# Basic traceroute
| trace host=google.com | table host, hops
# Limited hops
| trace target=example.com max_hops=15 | table hops_json
Query WHOIS servers for domain registration information.
| Parameter | Description | Required |
|---|---|---|
domain | Domain name to query | Yes |
domainfield | Field containing domain name | No |
# Basic lookup
| whois domain=google.com | table domain, registrar, creation_date, expiry_date
# Batch lookup
| inputlookup domains.csv | whois domainfield=domain | table domain, expiry_date
Securely transfer files using SSH.
| Parameter | Description | Required |
|---|---|---|
mode | get (download) or put (upload) | Yes |
source | Source file path | Yes |
destination | Destination path | Yes |
recursive | Copy directories recursively | No |
identityfile | SSH private key file | No |
# Download file
| scp mode=get source=user@server.com:/remote/file.txt destination=/local/dir
# Upload directory
| scp mode=put source=/local/dir destination=user@server.com:/remote/dir recursive=true
Interactive SFTP client for file transfers.
| Parameter | Description | Required |
|---|---|---|
host | Remote host (user@host) | Yes |
action | ls, get, put, mkdir, rm, cd | Yes |
remote_path | Remote file/directory path | No |
local_path | Local file/directory path | No |
# List directory
| sftp host=admin@server.com action=ls remote_path=/home | table files_json
# Download file
| sftp host=admin@server.com action=get remote_path=/remote/file.txt local_path=/local
Legacy FTP client for file operations.
| Parameter | Description | Required |
|---|---|---|
host | FTP server hostname | Yes |
action | ls, get, put, cd | Yes |
file | Filename for get/put | No |
username | FTP username | No |
Test TCP port connectivity.
| Parameter | Description | Required |
|---|---|---|
host | Target hostname or IP | Yes |
port | TCP port number | Yes |
timeout | Connection timeout in seconds | No |
# Test SSH port
| telnet host=server.com port=22 | table host, port, connected
# Batch port scan
| makeresults | eval ports=mvappend(22,80,443) | mvexpand ports | eval port=ports | telnet host=server.com port=port
Read local files or remote URLs.
| Parameter | Description | Required |
|---|---|---|
path | Local file path | Yes* |
url | Remote file URL | Yes* |
lines | Number of lines to read | No |
tail | Read from end of file | No |
# Read local file
| file path=/var/log/syslog lines=100 | table content
# Read remote URL
| file url=https://example.com/data.txt | table content, status_code
Run Ookla Speedtest for network performance benchmarking.
| Parameter | Description | Required |
|---|---|---|
mode | json (default) or csv | No |
server_id | Specific Speedtest server ID | No |
share | Share results online | No |
# Basic speed test
| speedtest mode=json | table download_mbps, upload_mbps, ping_ms
# Share results
| speedtest mode=json share=true accept_license=true | table download_mbps, share_url
Automate Let's Encrypt certificate operations via Certbot.
| Parameter | Description | Required |
|---|---|---|
mode | certonly, renew, status, revoke | Yes |
domain | Domain name(s) | Yes |
email | Contact email | No |
dryrun | Test without issuing | No |
# Dry-run test
| letsencrypt mode=certonly domain=example.com email=admin@example.com dryrun=true
# Renew certificate
| letsencrypt mode=renew domain=example.com
Encode field values for URL-safe format.
# Encode field
| makeresults | eval param="hello world & more" | urlencode param | table param
# Build API URL
| makeresults | eval search="test query" | urlencode search | eval url="https://api.example.com?q=" . search
For each command, you can get built-in help by running:
| command_name help
For technical support, contact: support@bentleypc.com