Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Lacework Provider
  3. API Docs
  4. AlertChannelSplunk
lacework 2.0.6 published on Monday, Apr 14, 2025 by lacework
lacework/terraform-provider-lacework

lacework.AlertChannelSplunk

Explore with Pulumi AI

lacework 2.0.6 published on Monday, Apr 14, 2025 by lacework
lacework/terraform-provider-lacework

You can use this resource to enable Lacework to forward alerts to Splunk using an HTTP Event Collector.

To find more information see the Lacework support documentation.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as lacework from "@pulumi/lacework";

const opsCritical = new lacework.AlertChannelSplunk("opsCritical", {
    eventData: {
        index: "index",
        source: "source",
    },
    hecToken: "BA696D5E-CA2F-4347-97CB-3C89F834816F",
    host: "localhost",
    port: 80,
});
Copy
import pulumi
import pulumi_lacework as lacework

ops_critical = lacework.AlertChannelSplunk("opsCritical",
    event_data={
        "index": "index",
        "source": "source",
    },
    hec_token="BA696D5E-CA2F-4347-97CB-3C89F834816F",
    host="localhost",
    port=80)
Copy
package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/lacework/v2/lacework"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := lacework.NewAlertChannelSplunk(ctx, "opsCritical", &lacework.AlertChannelSplunkArgs{
			EventData: &lacework.AlertChannelSplunkEventDataArgs{
				Index:  pulumi.String("index"),
				Source: pulumi.String("source"),
			},
			HecToken: pulumi.String("BA696D5E-CA2F-4347-97CB-3C89F834816F"),
			Host:     pulumi.String("localhost"),
			Port:     pulumi.Float64(80),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Copy
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Lacework = Pulumi.Lacework;

return await Deployment.RunAsync(() => 
{
    var opsCritical = new Lacework.AlertChannelSplunk("opsCritical", new()
    {
        EventData = new Lacework.Inputs.AlertChannelSplunkEventDataArgs
        {
            Index = "index",
            Source = "source",
        },
        HecToken = "BA696D5E-CA2F-4347-97CB-3C89F834816F",
        Host = "localhost",
        Port = 80,
    });

});
Copy
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.lacework.AlertChannelSplunk;
import com.pulumi.lacework.AlertChannelSplunkArgs;
import com.pulumi.lacework.inputs.AlertChannelSplunkEventDataArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var opsCritical = new AlertChannelSplunk("opsCritical", AlertChannelSplunkArgs.builder()
            .eventData(AlertChannelSplunkEventDataArgs.builder()
                .index("index")
                .source("source")
                .build())
            .hecToken("BA696D5E-CA2F-4347-97CB-3C89F834816F")
            .host("localhost")
            .port("80")
            .build());

    }
}
Copy
resources:
  opsCritical:
    type: lacework:AlertChannelSplunk
    properties:
      eventData:
        index: index
        source: source
      hecToken: BA696D5E-CA2F-4347-97CB-3C89F834816F
      host: localhost
      port: '80'
Copy

Create AlertChannelSplunk Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new AlertChannelSplunk(name: string, args: AlertChannelSplunkArgs, opts?: CustomResourceOptions);
@overload
def AlertChannelSplunk(resource_name: str,
                       args: AlertChannelSplunkArgs,
                       opts: Optional[ResourceOptions] = None)

@overload
def AlertChannelSplunk(resource_name: str,
                       opts: Optional[ResourceOptions] = None,
                       event_data: Optional[AlertChannelSplunkEventDataArgs] = None,
                       hec_token: Optional[str] = None,
                       host: Optional[str] = None,
                       port: Optional[float] = None,
                       alert_channel_splunk_id: Optional[str] = None,
                       channel: Optional[str] = None,
                       enabled: Optional[bool] = None,
                       name: Optional[str] = None,
                       ssl: Optional[bool] = None,
                       test_integration: Optional[bool] = None)
func NewAlertChannelSplunk(ctx *Context, name string, args AlertChannelSplunkArgs, opts ...ResourceOption) (*AlertChannelSplunk, error)
public AlertChannelSplunk(string name, AlertChannelSplunkArgs args, CustomResourceOptions? opts = null)
public AlertChannelSplunk(String name, AlertChannelSplunkArgs args)
public AlertChannelSplunk(String name, AlertChannelSplunkArgs args, CustomResourceOptions options)

type: lacework:AlertChannelSplunk
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name This property is required. string
The unique name of the resource.
args This property is required. AlertChannelSplunkArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name This property is required. str
The unique name of the resource.
args This property is required. AlertChannelSplunkArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name This property is required. string
The unique name of the resource.
args This property is required. AlertChannelSplunkArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name This property is required. string
The unique name of the resource.
args This property is required. AlertChannelSplunkArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name This property is required. String
The unique name of the resource.
args This property is required. AlertChannelSplunkArgs
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var alertChannelSplunkResource = new Lacework.AlertChannelSplunk("alertChannelSplunkResource", new()
{
    EventData = new Lacework.Inputs.AlertChannelSplunkEventDataArgs
    {
        Index = "string",
        Source = "string",
    },
    HecToken = "string",
    Host = "string",
    Port = 0,
    AlertChannelSplunkId = "string",
    Channel = "string",
    Enabled = false,
    Name = "string",
    Ssl = false,
    TestIntegration = false,
});
Copy
example, err := lacework.NewAlertChannelSplunk(ctx, "alertChannelSplunkResource", &lacework.AlertChannelSplunkArgs{
EventData: &.AlertChannelSplunkEventDataArgs{
Index: pulumi.String("string"),
Source: pulumi.String("string"),
},
HecToken: pulumi.String("string"),
Host: pulumi.String("string"),
Port: pulumi.Float64(0),
AlertChannelSplunkId: pulumi.String("string"),
Channel: pulumi.String("string"),
Enabled: pulumi.Bool(false),
Name: pulumi.String("string"),
Ssl: pulumi.Bool(false),
TestIntegration: pulumi.Bool(false),
})
Copy
var alertChannelSplunkResource = new AlertChannelSplunk("alertChannelSplunkResource", AlertChannelSplunkArgs.builder()
    .eventData(AlertChannelSplunkEventDataArgs.builder()
        .index("string")
        .source("string")
        .build())
    .hecToken("string")
    .host("string")
    .port(0)
    .alertChannelSplunkId("string")
    .channel("string")
    .enabled(false)
    .name("string")
    .ssl(false)
    .testIntegration(false)
    .build());
Copy
alert_channel_splunk_resource = lacework.AlertChannelSplunk("alertChannelSplunkResource",
    event_data={
        "index": "string",
        "source": "string",
    },
    hec_token="string",
    host="string",
    port=0,
    alert_channel_splunk_id="string",
    channel="string",
    enabled=False,
    name="string",
    ssl=False,
    test_integration=False)
Copy
const alertChannelSplunkResource = new lacework.AlertChannelSplunk("alertChannelSplunkResource", {
    eventData: {
        index: "string",
        source: "string",
    },
    hecToken: "string",
    host: "string",
    port: 0,
    alertChannelSplunkId: "string",
    channel: "string",
    enabled: false,
    name: "string",
    ssl: false,
    testIntegration: false,
});
Copy
type: lacework:AlertChannelSplunk
properties:
    alertChannelSplunkId: string
    channel: string
    enabled: false
    eventData:
        index: string
        source: string
    hecToken: string
    host: string
    name: string
    port: 0
    ssl: false
    testIntegration: false
Copy

AlertChannelSplunk Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The AlertChannelSplunk resource accepts the following input properties:

EventData This property is required. AlertChannelSplunkEventData
HecToken This property is required. string
The token you generate when you create a new HEC input.
Host This property is required. string
The hostname of the client from which you're sending data.
Port This property is required. double
The destination port for forwarding events.
AlertChannelSplunkId string
Channel string
The Splunk channel name.
Enabled bool
The state of the external integration. Defaults to true.
Name string
The Alert Channel integration name.
Ssl bool
Enable or Disable SSL.
TestIntegration bool
Whether to test the integration of an alert channel upon creation and modification
EventData This property is required. AlertChannelSplunkEventDataArgs
HecToken This property is required. string
The token you generate when you create a new HEC input.
Host This property is required. string
The hostname of the client from which you're sending data.
Port This property is required. float64
The destination port for forwarding events.
AlertChannelSplunkId string
Channel string
The Splunk channel name.
Enabled bool
The state of the external integration. Defaults to true.
Name string
The Alert Channel integration name.
Ssl bool
Enable or Disable SSL.
TestIntegration bool
Whether to test the integration of an alert channel upon creation and modification
eventData This property is required. AlertChannelSplunkEventData
hecToken This property is required. String
The token you generate when you create a new HEC input.
host This property is required. String
The hostname of the client from which you're sending data.
port This property is required. Double
The destination port for forwarding events.
alertChannelSplunkId String
channel String
The Splunk channel name.
enabled Boolean
The state of the external integration. Defaults to true.
name String
The Alert Channel integration name.
ssl Boolean
Enable or Disable SSL.
testIntegration Boolean
Whether to test the integration of an alert channel upon creation and modification
eventData This property is required. AlertChannelSplunkEventData
hecToken This property is required. string
The token you generate when you create a new HEC input.
host This property is required. string
The hostname of the client from which you're sending data.
port This property is required. number
The destination port for forwarding events.
alertChannelSplunkId string
channel string
The Splunk channel name.
enabled boolean
The state of the external integration. Defaults to true.
name string
The Alert Channel integration name.
ssl boolean
Enable or Disable SSL.
testIntegration boolean
Whether to test the integration of an alert channel upon creation and modification
event_data This property is required. AlertChannelSplunkEventDataArgs
hec_token This property is required. str
The token you generate when you create a new HEC input.
host This property is required. str
The hostname of the client from which you're sending data.
port This property is required. float
The destination port for forwarding events.
alert_channel_splunk_id str
channel str
The Splunk channel name.
enabled bool
The state of the external integration. Defaults to true.
name str
The Alert Channel integration name.
ssl bool
Enable or Disable SSL.
test_integration bool
Whether to test the integration of an alert channel upon creation and modification
eventData This property is required. Property Map
hecToken This property is required. String
The token you generate when you create a new HEC input.
host This property is required. String
The hostname of the client from which you're sending data.
port This property is required. Number
The destination port for forwarding events.
alertChannelSplunkId String
channel String
The Splunk channel name.
enabled Boolean
The state of the external integration. Defaults to true.
name String
The Alert Channel integration name.
ssl Boolean
Enable or Disable SSL.
testIntegration Boolean
Whether to test the integration of an alert channel upon creation and modification

Outputs

All input properties are implicitly available as output properties. Additionally, the AlertChannelSplunk resource produces the following output properties:

CreatedOrUpdatedBy string
CreatedOrUpdatedTime string
Id string
The provider-assigned unique ID for this managed resource.
IntgGuid string
OrgLevel bool
TypeName string
CreatedOrUpdatedBy string
CreatedOrUpdatedTime string
Id string
The provider-assigned unique ID for this managed resource.
IntgGuid string
OrgLevel bool
TypeName string
createdOrUpdatedBy String
createdOrUpdatedTime String
id String
The provider-assigned unique ID for this managed resource.
intgGuid String
orgLevel Boolean
typeName String
createdOrUpdatedBy string
createdOrUpdatedTime string
id string
The provider-assigned unique ID for this managed resource.
intgGuid string
orgLevel boolean
typeName string
created_or_updated_by str
created_or_updated_time str
id str
The provider-assigned unique ID for this managed resource.
intg_guid str
org_level bool
type_name str
createdOrUpdatedBy String
createdOrUpdatedTime String
id String
The provider-assigned unique ID for this managed resource.
intgGuid String
orgLevel Boolean
typeName String

Look up Existing AlertChannelSplunk Resource

Get an existing AlertChannelSplunk resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: AlertChannelSplunkState, opts?: CustomResourceOptions): AlertChannelSplunk
@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        alert_channel_splunk_id: Optional[str] = None,
        channel: Optional[str] = None,
        created_or_updated_by: Optional[str] = None,
        created_or_updated_time: Optional[str] = None,
        enabled: Optional[bool] = None,
        event_data: Optional[AlertChannelSplunkEventDataArgs] = None,
        hec_token: Optional[str] = None,
        host: Optional[str] = None,
        intg_guid: Optional[str] = None,
        name: Optional[str] = None,
        org_level: Optional[bool] = None,
        port: Optional[float] = None,
        ssl: Optional[bool] = None,
        test_integration: Optional[bool] = None,
        type_name: Optional[str] = None) -> AlertChannelSplunk
func GetAlertChannelSplunk(ctx *Context, name string, id IDInput, state *AlertChannelSplunkState, opts ...ResourceOption) (*AlertChannelSplunk, error)
public static AlertChannelSplunk Get(string name, Input<string> id, AlertChannelSplunkState? state, CustomResourceOptions? opts = null)
public static AlertChannelSplunk get(String name, Output<String> id, AlertChannelSplunkState state, CustomResourceOptions options)
resources:  _:    type: lacework:AlertChannelSplunk    get:      id: ${id}
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
The following state arguments are supported:
AlertChannelSplunkId string
Channel string
The Splunk channel name.
CreatedOrUpdatedBy string
CreatedOrUpdatedTime string
Enabled bool
The state of the external integration. Defaults to true.
EventData AlertChannelSplunkEventData
HecToken string
The token you generate when you create a new HEC input.
Host string
The hostname of the client from which you're sending data.
IntgGuid string
Name string
The Alert Channel integration name.
OrgLevel bool
Port double
The destination port for forwarding events.
Ssl bool
Enable or Disable SSL.
TestIntegration bool
Whether to test the integration of an alert channel upon creation and modification
TypeName string
AlertChannelSplunkId string
Channel string
The Splunk channel name.
CreatedOrUpdatedBy string
CreatedOrUpdatedTime string
Enabled bool
The state of the external integration. Defaults to true.
EventData AlertChannelSplunkEventDataArgs
HecToken string
The token you generate when you create a new HEC input.
Host string
The hostname of the client from which you're sending data.
IntgGuid string
Name string
The Alert Channel integration name.
OrgLevel bool
Port float64
The destination port for forwarding events.
Ssl bool
Enable or Disable SSL.
TestIntegration bool
Whether to test the integration of an alert channel upon creation and modification
TypeName string
alertChannelSplunkId String
channel String
The Splunk channel name.
createdOrUpdatedBy String
createdOrUpdatedTime String
enabled Boolean
The state of the external integration. Defaults to true.
eventData AlertChannelSplunkEventData
hecToken String
The token you generate when you create a new HEC input.
host String
The hostname of the client from which you're sending data.
intgGuid String
name String
The Alert Channel integration name.
orgLevel Boolean
port Double
The destination port for forwarding events.
ssl Boolean
Enable or Disable SSL.
testIntegration Boolean
Whether to test the integration of an alert channel upon creation and modification
typeName String
alertChannelSplunkId string
channel string
The Splunk channel name.
createdOrUpdatedBy string
createdOrUpdatedTime string
enabled boolean
The state of the external integration. Defaults to true.
eventData AlertChannelSplunkEventData
hecToken string
The token you generate when you create a new HEC input.
host string
The hostname of the client from which you're sending data.
intgGuid string
name string
The Alert Channel integration name.
orgLevel boolean
port number
The destination port for forwarding events.
ssl boolean
Enable or Disable SSL.
testIntegration boolean
Whether to test the integration of an alert channel upon creation and modification
typeName string
alert_channel_splunk_id str
channel str
The Splunk channel name.
created_or_updated_by str
created_or_updated_time str
enabled bool
The state of the external integration. Defaults to true.
event_data AlertChannelSplunkEventDataArgs
hec_token str
The token you generate when you create a new HEC input.
host str
The hostname of the client from which you're sending data.
intg_guid str
name str
The Alert Channel integration name.
org_level bool
port float
The destination port for forwarding events.
ssl bool
Enable or Disable SSL.
test_integration bool
Whether to test the integration of an alert channel upon creation and modification
type_name str
alertChannelSplunkId String
channel String
The Splunk channel name.
createdOrUpdatedBy String
createdOrUpdatedTime String
enabled Boolean
The state of the external integration. Defaults to true.
eventData Property Map
hecToken String
The token you generate when you create a new HEC input.
host String
The hostname of the client from which you're sending data.
intgGuid String
name String
The Alert Channel integration name.
orgLevel Boolean
port Number
The destination port for forwarding events.
ssl Boolean
Enable or Disable SSL.
testIntegration Boolean
Whether to test the integration of an alert channel upon creation and modification
typeName String

Supporting Types

AlertChannelSplunkEventData
, AlertChannelSplunkEventDataArgs

Index This property is required. string
Index to store generated events.
Source This property is required. string
The Splunk source.
Index This property is required. string
Index to store generated events.
Source This property is required. string
The Splunk source.
index This property is required. String
Index to store generated events.
source This property is required. String
The Splunk source.
index This property is required. string
Index to store generated events.
source This property is required. string
The Splunk source.
index This property is required. str
Index to store generated events.
source This property is required. str
The Splunk source.
index This property is required. String
Index to store generated events.
source This property is required. String
The Splunk source.

Import

A Lacework Splunk Alert Channel integration can be imported using a INT_GUID, e.g.

$ pulumi import lacework:index/alertChannelSplunk:AlertChannelSplunk ops_critical EXAMPLE_1234BAE1E42182964D23973F44CFEA3C4AB63B99E9A1EC5
Copy

-> Note: To retrieve the INT_GUID from existing integrations in your account, use the Lacework CLI command lacework alert-channel list. To install this tool follow this documentation.

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository
lacework lacework/terraform-provider-lacework
License
Notes
This Pulumi package is based on the lacework Terraform Provider.
lacework 2.0.6 published on Monday, Apr 14, 2025 by lacework
lacework/terraform-provider-lacework