{"name":"splunk","version":"1.2.24","description":"A Pulumi package for creating and managing splunk cloud resources.","keywords":["pulumi","splunk"],"homepage":"https://pulumi.io","license":"Apache-2.0","attribution":"This Pulumi package is based on the [`splunk` Terraform Provider](https://github.com/splunk/terraform-provider-splunk).","repository":"https://github.com/pulumi/pulumi-splunk","meta":{"moduleFormat":"(.*)(?:/[^/]*)"},"language":{"csharp":{"packageReferences":{"Pulumi":"3.*-*"},"compatibility":"tfbridge20","respectSchemaVersion":true},"go":{"importBasePath":"github.com/pulumi/pulumi-splunk/sdk/go/splunk","generateResourceContainerTypes":true,"generateExtraInputTypes":true,"respectSchemaVersion":true},"nodejs":{"packageDescription":"A Pulumi package for creating and managing splunk cloud resources.","readme":"\u003e This provider is a derived work of the [Terraform Provider](https://github.com/splunk/terraform-provider-splunk)\n\u003e distributed under [MPL 2.0](https://www.mozilla.org/en-US/MPL/2.0/). If you encounter a bug or missing feature,\n\u003e first check the [`pulumi-splunk` repo](https://github.com/pulumi/pulumi-splunk/issues); however, if that doesn't turn up anything,\n\u003e please consult the source [`terraform-provider-splunk` repo](https://github.com/splunk/terraform-provider-splunk/issues).","dependencies":{"@pulumi/pulumi":"^3.0.0-alpha.0"},"devDependencies":{"@types/mime":"^2.0.0","@types/node":"^10.0.0"},"compatibility":"tfbridge20","disableUnionOutputTypes":true,"respectSchemaVersion":true},"python":{"requires":{"pulumi":"\u003e=3.0.0a1,\u003c4.0.0"},"readme":"\u003e This provider is a derived work of the [Terraform Provider](https://github.com/splunk/terraform-provider-splunk)\n\u003e distributed under [MPL 2.0](https://www.mozilla.org/en-US/MPL/2.0/). If you encounter a bug or missing feature,\n\u003e first check the [`pulumi-splunk` repo](https://github.com/pulumi/pulumi-splunk/issues); however, if that doesn't turn up anything,\n\u003e please consult the source [`terraform-provider-splunk` repo](https://github.com/splunk/terraform-provider-splunk/issues).","compatibility":"tfbridge20","respectSchemaVersion":true,"pyproject":{"enabled":true}}},"config":{"variables":{"authToken":{"type":"string","description":"Authentication tokens, also known as JSON Web Tokens (JWT), are a method for authenticating Splunk platform users into the Splunk platform"},"insecureSkipVerify":{"type":"boolean","description":"insecure skip verification flag"},"password":{"type":"string","description":"Splunk instance password"},"timeout":{"type":"integer","description":"Timeout when making calls to Splunk server. Defaults to 60 seconds"},"url":{"type":"string","description":"Splunk instance URL"},"username":{"type":"string","description":"Splunk instance admin username"}},"defaults":["url"]},"types":{"splunk:index/AppsLocalAcl:AppsLocalAcl":{"properties":{"app":{"type":"string","description":"The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system\n","willReplaceOnChanges":true},"canChangePerms":{"type":"boolean","description":"Indicates if the active user can change permissions for this object. Defaults to true.\n"},"canShareApp":{"type":"boolean","description":"Indicates if the active user can change sharing to app level. Defaults to true.\n"},"canShareGlobal":{"type":"boolean","description":"Indicates if the active user can change sharing to system level. Defaults to true.\n"},"canShareUser":{"type":"boolean","description":"Indicates if the active user can change sharing to user level. Defaults to true.\n"},"canWrite":{"type":"boolean","description":"Indicates if the active user can edit this object. Defaults to true.\n"},"owner":{"type":"string","description":"User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.\n"},"reads":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource read permissions.\n"},"removable":{"type":"boolean","description":"Indicates whether an admin or user with sufficient permissions can delete the entity.\n"},"sharing":{"type":"string","description":"Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user\n","willReplaceOnChanges":true},"writes":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource write permissions.\n"}},"type":"object","language":{"nodejs":{"requiredOutputs":["app","canChangePerms","canShareApp","canShareGlobal","canShareUser","canWrite","owner","reads","removable","sharing","writes"]}}},"splunk:index/ConfigsConfAcl:ConfigsConfAcl":{"properties":{"app":{"type":"string","description":"The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system\n","willReplaceOnChanges":true},"canChangePerms":{"type":"boolean","description":"Indicates if the active user can change permissions for this object. Defaults to true.\n"},"canShareApp":{"type":"boolean","description":"Indicates if the active user can change sharing to app level. Defaults to true.\n"},"canShareGlobal":{"type":"boolean","description":"Indicates if the active user can change sharing to system level. Defaults to true.\n"},"canShareUser":{"type":"boolean","description":"Indicates if the active user can change sharing to user level. Defaults to true.\n"},"canWrite":{"type":"boolean","description":"Indicates if the active user can edit this object. Defaults to true.\n"},"owner":{"type":"string","description":"User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.\n"},"reads":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource read permissions.\n"},"removable":{"type":"boolean","description":"Indicates whether an admin or user with sufficient permissions can delete the entity.\n"},"sharing":{"type":"string","description":"Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user\n","willReplaceOnChanges":true},"writes":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource write permissions.\n"}},"type":"object","language":{"nodejs":{"requiredOutputs":["app","canChangePerms","canShareApp","canShareGlobal","canShareUser","canWrite","owner","reads","removable","sharing","writes"]}}},"splunk:index/DataUiViewsAcl:DataUiViewsAcl":{"properties":{"app":{"type":"string","description":"The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system\n","willReplaceOnChanges":true},"canChangePerms":{"type":"boolean","description":"Indicates if the active user can change permissions for this object. Defaults to true.\n"},"canShareApp":{"type":"boolean","description":"Indicates if the active user can change sharing to app level. Defaults to true.\n"},"canShareGlobal":{"type":"boolean","description":"Indicates if the active user can change sharing to system level. Defaults to true.\n"},"canShareUser":{"type":"boolean","description":"Indicates if the active user can change sharing to user level. Defaults to true.\n"},"canWrite":{"type":"boolean","description":"Indicates if the active user can edit this object. Defaults to true.\n"},"owner":{"type":"string","description":"User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.\n"},"reads":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource read permissions.\n"},"removable":{"type":"boolean","description":"Indicates whether an admin or user with sufficient permissions can delete the entity.\n"},"sharing":{"type":"string","description":"Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user\n","willReplaceOnChanges":true},"writes":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource write permissions.\n"}},"type":"object","language":{"nodejs":{"requiredOutputs":["app","canChangePerms","canShareApp","canShareGlobal","canShareUser","canWrite","owner","reads","removable","sharing","writes"]}}},"splunk:index/GenericAclAcl:GenericAclAcl":{"properties":{"app":{"type":"string","description":"The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system\n","willReplaceOnChanges":true},"canChangePerms":{"type":"boolean","description":"Indicates if the active user can change permissions for this object. Defaults to true.\n"},"canShareApp":{"type":"boolean","description":"Indicates if the active user can change sharing to app level. Defaults to true.\n"},"canShareGlobal":{"type":"boolean","description":"Indicates if the active user can change sharing to system level. Defaults to true.\n"},"canShareUser":{"type":"boolean","description":"Indicates if the active user can change sharing to user level. Defaults to true.\n"},"canWrite":{"type":"boolean","description":"Indicates if the active user can edit this object. Defaults to true.\n"},"owner":{"type":"string","description":"User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.\n"},"reads":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource read permissions.\n"},"removable":{"type":"boolean","description":"Indicates whether an admin or user with sufficient permissions can delete the entity.\n"},"sharing":{"type":"string","description":"Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user\n","willReplaceOnChanges":true},"writes":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource write permissions.\n"}},"type":"object","language":{"nodejs":{"requiredOutputs":["app","canChangePerms","canShareApp","canShareGlobal","canShareUser","canWrite","owner","reads","removable","sharing","writes"]}}},"splunk:index/IndexesAcl:IndexesAcl":{"properties":{"app":{"type":"string","description":"The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system\n","willReplaceOnChanges":true},"canChangePerms":{"type":"boolean","description":"Indicates if the active user can change permissions for this object. Defaults to true.\n"},"canShareApp":{"type":"boolean","description":"Indicates if the active user can change sharing to app level. Defaults to true.\n"},"canShareGlobal":{"type":"boolean","description":"Indicates if the active user can change sharing to system level. Defaults to true.\n"},"canShareUser":{"type":"boolean","description":"Indicates if the active user can change sharing to user level. Defaults to true.\n"},"canWrite":{"type":"boolean","description":"Indicates if the active user can edit this object. Defaults to true.\n"},"owner":{"type":"string","description":"User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.\n"},"reads":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource read permissions.\n"},"removable":{"type":"boolean","description":"Indicates whether an admin or user with sufficient permissions can delete the entity.\n"},"sharing":{"type":"string","description":"Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user\n","willReplaceOnChanges":true},"writes":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource write permissions.\n"}},"type":"object","language":{"nodejs":{"requiredOutputs":["app","canChangePerms","canShareApp","canShareGlobal","canShareUser","canWrite","owner","reads","removable","sharing","writes"]}}},"splunk:index/InputsHttpEventCollectorAcl:InputsHttpEventCollectorAcl":{"properties":{"app":{"type":"string","description":"The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system\n","willReplaceOnChanges":true},"canChangePerms":{"type":"boolean","description":"Indicates if the active user can change permissions for this object. Defaults to true.\n"},"canShareApp":{"type":"boolean","description":"Indicates if the active user can change sharing to app level. Defaults to true.\n"},"canShareGlobal":{"type":"boolean","description":"Indicates if the active user can change sharing to system level. Defaults to true.\n"},"canShareUser":{"type":"boolean","description":"Indicates if the active user can change sharing to user level. Defaults to true.\n"},"canWrite":{"type":"boolean","description":"Indicates if the active user can edit this object. Defaults to true.\n"},"owner":{"type":"string","description":"User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.\n"},"reads":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource read permissions.\n"},"removable":{"type":"boolean","description":"Indicates whether an admin or user with sufficient permissions can delete the entity.\n"},"sharing":{"type":"string","description":"Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user\n","willReplaceOnChanges":true},"writes":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource write permissions.\n"}},"type":"object","language":{"nodejs":{"requiredOutputs":["app","canChangePerms","canShareApp","canShareGlobal","canShareUser","canWrite","owner","reads","removable","sharing","writes"]}}},"splunk:index/InputsMonitorAcl:InputsMonitorAcl":{"properties":{"app":{"type":"string","description":"The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system\n","willReplaceOnChanges":true},"canChangePerms":{"type":"boolean","description":"Indicates if the active user can change permissions for this object. Defaults to true.\n"},"canShareApp":{"type":"boolean","description":"Indicates if the active user can change sharing to app level. Defaults to true.\n"},"canShareGlobal":{"type":"boolean","description":"Indicates if the active user can change sharing to system level. Defaults to true.\n"},"canShareUser":{"type":"boolean","description":"Indicates if the active user can change sharing to user level. Defaults to true.\n"},"canWrite":{"type":"boolean","description":"Indicates if the active user can edit this object. Defaults to true.\n"},"owner":{"type":"string","description":"User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.\n"},"reads":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource read permissions.\n"},"removable":{"type":"boolean","description":"Indicates whether an admin or user with sufficient permissions can delete the entity.\n"},"sharing":{"type":"string","description":"Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user\n","willReplaceOnChanges":true},"writes":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource write permissions.\n"}},"type":"object","language":{"nodejs":{"requiredOutputs":["app","canChangePerms","canShareApp","canShareGlobal","canShareUser","canWrite","owner","reads","removable","sharing","writes"]}}},"splunk:index/InputsScriptAcl:InputsScriptAcl":{"properties":{"app":{"type":"string","description":"The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system\n","willReplaceOnChanges":true},"canChangePerms":{"type":"boolean","description":"Indicates if the active user can change permissions for this object. Defaults to true.\n"},"canShareApp":{"type":"boolean","description":"Indicates if the active user can change sharing to app level. Defaults to true.\n"},"canShareGlobal":{"type":"boolean","description":"Indicates if the active user can change sharing to system level. Defaults to true.\n"},"canShareUser":{"type":"boolean","description":"Indicates if the active user can change sharing to user level. Defaults to true.\n"},"canWrite":{"type":"boolean","description":"Indicates if the active user can edit this object. Defaults to true.\n"},"owner":{"type":"string","description":"User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.\n"},"reads":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource read permissions.\n"},"removable":{"type":"boolean","description":"Indicates whether an admin or user with sufficient permissions can delete the entity.\n"},"sharing":{"type":"string","description":"Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user\n","willReplaceOnChanges":true},"writes":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource write permissions.\n"}},"type":"object","language":{"nodejs":{"requiredOutputs":["app","canChangePerms","canShareApp","canShareGlobal","canShareUser","canWrite","owner","reads","removable","sharing","writes"]}}},"splunk:index/InputsTcpCookedAcl:InputsTcpCookedAcl":{"properties":{"app":{"type":"string","description":"The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system\n","willReplaceOnChanges":true},"canChangePerms":{"type":"boolean","description":"Indicates if the active user can change permissions for this object. Defaults to true.\n"},"canShareApp":{"type":"boolean","description":"Indicates if the active user can change sharing to app level. Defaults to true.\n"},"canShareGlobal":{"type":"boolean","description":"Indicates if the active user can change sharing to system level. Defaults to true.\n"},"canShareUser":{"type":"boolean","description":"Indicates if the active user can change sharing to user level. Defaults to true.\n"},"canWrite":{"type":"boolean","description":"Indicates if the active user can edit this object. Defaults to true.\n"},"owner":{"type":"string","description":"User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.\n"},"reads":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource read permissions.\n"},"removable":{"type":"boolean","description":"Indicates whether an admin or user with sufficient permissions can delete the entity.\n"},"sharing":{"type":"string","description":"Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user\n","willReplaceOnChanges":true},"writes":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource write permissions.\n"}},"type":"object","language":{"nodejs":{"requiredOutputs":["app","canChangePerms","canShareApp","canShareGlobal","canShareUser","canWrite","owner","reads","removable","sharing","writes"]}}},"splunk:index/InputsTcpRawAcl:InputsTcpRawAcl":{"properties":{"app":{"type":"string","description":"The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system\n","willReplaceOnChanges":true},"canChangePerms":{"type":"boolean","description":"Indicates if the active user can change permissions for this object. Defaults to true.\n"},"canShareApp":{"type":"boolean","description":"Indicates if the active user can change sharing to app level. Defaults to true.\n"},"canShareGlobal":{"type":"boolean","description":"Indicates if the active user can change sharing to system level. Defaults to true.\n"},"canShareUser":{"type":"boolean","description":"Indicates if the active user can change sharing to user level. Defaults to true.\n"},"canWrite":{"type":"boolean","description":"Indicates if the active user can edit this object. Defaults to true.\n"},"owner":{"type":"string","description":"User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.\n"},"reads":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource read permissions.\n"},"removable":{"type":"boolean","description":"Indicates whether an admin or user with sufficient permissions can delete the entity.\n"},"sharing":{"type":"string","description":"Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user\n","willReplaceOnChanges":true},"writes":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource write permissions.\n"}},"type":"object","language":{"nodejs":{"requiredOutputs":["app","canChangePerms","canShareApp","canShareGlobal","canShareUser","canWrite","owner","reads","removable","sharing","writes"]}}},"splunk:index/InputsTcpSplunkTcpTokenAcl:InputsTcpSplunkTcpTokenAcl":{"properties":{"app":{"type":"string","description":"The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system\n","willReplaceOnChanges":true},"canChangePerms":{"type":"boolean","description":"Indicates if the active user can change permissions for this object. Defaults to true.\n"},"canShareApp":{"type":"boolean","description":"Indicates if the active user can change sharing to app level. Defaults to true.\n"},"canShareGlobal":{"type":"boolean","description":"Indicates if the active user can change sharing to system level. Defaults to true.\n"},"canShareUser":{"type":"boolean","description":"Indicates if the active user can change sharing to user level. Defaults to true.\n"},"canWrite":{"type":"boolean","description":"Indicates if the active user can edit this object. Defaults to true.\n"},"owner":{"type":"string","description":"User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.\n"},"reads":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource read permissions.\n"},"removable":{"type":"boolean","description":"Indicates whether an admin or user with sufficient permissions can delete the entity.\n"},"sharing":{"type":"string","description":"Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user\n","willReplaceOnChanges":true},"writes":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource write permissions.\n"}},"type":"object","language":{"nodejs":{"requiredOutputs":["app","canChangePerms","canShareApp","canShareGlobal","canShareUser","canWrite","owner","reads","removable","sharing","writes"]}}},"splunk:index/InputsUdpAcl:InputsUdpAcl":{"properties":{"app":{"type":"string","description":"The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system\n","willReplaceOnChanges":true},"canChangePerms":{"type":"boolean","description":"Indicates if the active user can change permissions for this object. Defaults to true.\n"},"canShareApp":{"type":"boolean","description":"Indicates if the active user can change sharing to app level. Defaults to true.\n"},"canShareGlobal":{"type":"boolean","description":"Indicates if the active user can change sharing to system level. Defaults to true.\n"},"canShareUser":{"type":"boolean","description":"Indicates if the active user can change sharing to user level. Defaults to true.\n"},"canWrite":{"type":"boolean","description":"Indicates if the active user can edit this object. Defaults to true.\n"},"owner":{"type":"string","description":"User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.\n"},"reads":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource read permissions.\n"},"removable":{"type":"boolean","description":"Indicates whether an admin or user with sufficient permissions can delete the entity.\n"},"sharing":{"type":"string","description":"Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user\n","willReplaceOnChanges":true},"writes":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource write permissions.\n"}},"type":"object","language":{"nodejs":{"requiredOutputs":["app","canChangePerms","canShareApp","canShareGlobal","canShareUser","canWrite","owner","reads","removable","sharing","writes"]}}},"splunk:index/LookupDefinitionAcl:LookupDefinitionAcl":{"properties":{"app":{"type":"string","description":"The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system\n","willReplaceOnChanges":true},"canChangePerms":{"type":"boolean","description":"Indicates if the active user can change permissions for this object. Defaults to true.\n"},"canShareApp":{"type":"boolean","description":"Indicates if the active user can change sharing to app level. Defaults to true.\n"},"canShareGlobal":{"type":"boolean","description":"Indicates if the active user can change sharing to system level. Defaults to true.\n"},"canShareUser":{"type":"boolean","description":"Indicates if the active user can change sharing to user level. Defaults to true.\n"},"canWrite":{"type":"boolean","description":"Indicates if the active user can edit this object. Defaults to true.\n"},"owner":{"type":"string","description":"User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.\n"},"reads":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource read permissions.\n"},"removable":{"type":"boolean","description":"Indicates whether an admin or user with sufficient permissions can delete the entity.\n"},"sharing":{"type":"string","description":"Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user\n","willReplaceOnChanges":true},"writes":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource write permissions.\n"}},"type":"object","language":{"nodejs":{"requiredOutputs":["app","canChangePerms","canShareApp","canShareGlobal","canShareUser","canWrite","owner","reads","removable","sharing","writes"]}}},"splunk:index/OutputsTcpDefaultAcl:OutputsTcpDefaultAcl":{"properties":{"app":{"type":"string","description":"The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system\n","willReplaceOnChanges":true},"canChangePerms":{"type":"boolean","description":"Indicates if the active user can change permissions for this object. Defaults to true.\n"},"canShareApp":{"type":"boolean","description":"Indicates if the active user can change sharing to app level. Defaults to true.\n"},"canShareGlobal":{"type":"boolean","description":"Indicates if the active user can change sharing to system level. Defaults to true.\n"},"canShareUser":{"type":"boolean","description":"Indicates if the active user can change sharing to user level. Defaults to true.\n"},"canWrite":{"type":"boolean","description":"Indicates if the active user can edit this object. Defaults to true.\n"},"owner":{"type":"string","description":"User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.\n"},"reads":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource read permissions.\n"},"removable":{"type":"boolean","description":"Indicates whether an admin or user with sufficient permissions can delete the entity.\n"},"sharing":{"type":"string","description":"Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user\n","willReplaceOnChanges":true},"writes":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource write permissions.\n"}},"type":"object","language":{"nodejs":{"requiredOutputs":["app","canChangePerms","canShareApp","canShareGlobal","canShareUser","canWrite","owner","reads","removable","sharing","writes"]}}},"splunk:index/OutputsTcpGroupAcl:OutputsTcpGroupAcl":{"properties":{"app":{"type":"string","description":"The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system\n","willReplaceOnChanges":true},"canChangePerms":{"type":"boolean","description":"Indicates if the active user can change permissions for this object. Defaults to true.\n"},"canShareApp":{"type":"boolean","description":"Indicates if the active user can change sharing to app level. Defaults to true.\n"},"canShareGlobal":{"type":"boolean","description":"Indicates if the active user can change sharing to system level. Defaults to true.\n"},"canShareUser":{"type":"boolean","description":"Indicates if the active user can change sharing to user level. Defaults to true.\n"},"canWrite":{"type":"boolean","description":"Indicates if the active user can edit this object. Defaults to true.\n"},"owner":{"type":"string","description":"User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.\n"},"reads":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource read permissions.\n"},"removable":{"type":"boolean","description":"Indicates whether an admin or user with sufficient permissions can delete the entity.\n"},"sharing":{"type":"string","description":"Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user\n","willReplaceOnChanges":true},"writes":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource write permissions.\n"}},"type":"object","language":{"nodejs":{"requiredOutputs":["app","canChangePerms","canShareApp","canShareGlobal","canShareUser","canWrite","owner","reads","removable","sharing","writes"]}}},"splunk:index/OutputsTcpServerAcl:OutputsTcpServerAcl":{"properties":{"app":{"type":"string","description":"The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system\n","willReplaceOnChanges":true},"canChangePerms":{"type":"boolean","description":"Indicates if the active user can change permissions for this object. Defaults to true.\n"},"canShareApp":{"type":"boolean","description":"Indicates if the active user can change sharing to app level. Defaults to true.\n"},"canShareGlobal":{"type":"boolean","description":"Indicates if the active user can change sharing to system level. Defaults to true.\n"},"canShareUser":{"type":"boolean","description":"Indicates if the active user can change sharing to user level. Defaults to true.\n"},"canWrite":{"type":"boolean","description":"Indicates if the active user can edit this object. Defaults to true.\n"},"owner":{"type":"string","description":"User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.\n"},"reads":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource read permissions.\n"},"removable":{"type":"boolean","description":"Indicates whether an admin or user with sufficient permissions can delete the entity.\n"},"sharing":{"type":"string","description":"Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user\n","willReplaceOnChanges":true},"writes":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource write permissions.\n"}},"type":"object","language":{"nodejs":{"requiredOutputs":["app","canChangePerms","canShareApp","canShareGlobal","canShareUser","canWrite","owner","reads","removable","sharing","writes"]}}},"splunk:index/OutputsTcpSyslogAcl:OutputsTcpSyslogAcl":{"properties":{"app":{"type":"string","description":"The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system\n","willReplaceOnChanges":true},"canChangePerms":{"type":"boolean","description":"Indicates if the active user can change permissions for this object. Defaults to true.\n"},"canShareApp":{"type":"boolean","description":"Indicates if the active user can change sharing to app level. Defaults to true.\n"},"canShareGlobal":{"type":"boolean","description":"Indicates if the active user can change sharing to system level. Defaults to true.\n"},"canShareUser":{"type":"boolean","description":"Indicates if the active user can change sharing to user level. Defaults to true.\n"},"canWrite":{"type":"boolean","description":"Indicates if the active user can edit this object. Defaults to true.\n"},"owner":{"type":"string","description":"User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.\n"},"reads":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource read permissions.\n"},"removable":{"type":"boolean","description":"Indicates whether an admin or user with sufficient permissions can delete the entity.\n"},"sharing":{"type":"string","description":"Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user\n","willReplaceOnChanges":true},"writes":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource write permissions.\n"}},"type":"object","language":{"nodejs":{"requiredOutputs":["app","canChangePerms","canShareApp","canShareGlobal","canShareUser","canWrite","owner","reads","removable","sharing","writes"]}}},"splunk:index/SavedSearchesAcl:SavedSearchesAcl":{"properties":{"app":{"type":"string","description":"The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system\n","willReplaceOnChanges":true},"canChangePerms":{"type":"boolean","description":"Indicates if the active user can change permissions for this object. Defaults to true.\n"},"canShareApp":{"type":"boolean","description":"Indicates if the active user can change sharing to app level. Defaults to true.\n"},"canShareGlobal":{"type":"boolean","description":"Indicates if the active user can change sharing to system level. Defaults to true.\n"},"canShareUser":{"type":"boolean","description":"Indicates if the active user can change sharing to user level. Defaults to true.\n"},"canWrite":{"type":"boolean","description":"Indicates if the active user can edit this object. Defaults to true.\n"},"owner":{"type":"string","description":"User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.\n"},"reads":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource read permissions.\n"},"removable":{"type":"boolean","description":"Indicates whether an admin or user with sufficient permissions can delete the entity.\n"},"sharing":{"type":"string","description":"Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user\n","willReplaceOnChanges":true},"writes":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource write permissions.\n"}},"type":"object","language":{"nodejs":{"requiredOutputs":["app","canChangePerms","canShareApp","canShareGlobal","canShareUser","canWrite","owner","reads","removable","sharing","writes"]}}},"splunk:index/ShIndexesManagerAcl:ShIndexesManagerAcl":{"properties":{"app":{"type":"string","description":"The app context for the resource. Required for updating saved search ACL properties. Allowed values are:The name of an app and system\n","willReplaceOnChanges":true},"canChangePerms":{"type":"boolean","description":"Indicates if the active user can change permissions for this object. Defaults to true.\n"},"canShareApp":{"type":"boolean","description":"Indicates if the active user can change sharing to app level. Defaults to true.\n"},"canShareGlobal":{"type":"boolean","description":"Indicates if the active user can change sharing to system level. Defaults to true.\n"},"canShareUser":{"type":"boolean","description":"Indicates if the active user can change sharing to user level. Defaults to true.\n"},"canWrite":{"type":"boolean","description":"Indicates if the active user can edit this object. Defaults to true.\n"},"owner":{"type":"string","description":"User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties.nobody = All users may access the resource, but write access to the resource might be restricted.\n"},"reads":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource read permissions.\n"},"removable":{"type":"boolean","description":"Indicates whether an admin or user with sufficient permissions can delete the entity.\n"},"sharing":{"type":"string","description":"Indicates how the resource is shared. Required for updating any knowledge object ACL properties.app: Shared within a specific appglobal: (Default) Shared globally to all apps.user: Private to a user\n","willReplaceOnChanges":true},"writes":{"type":"array","items":{"type":"string"},"description":"Properties that indicate resource write permissions.\n"}},"type":"object","language":{"nodejs":{"requiredOutputs":["app","canChangePerms","canShareApp","canShareGlobal","canShareUser","canWrite","owner","reads","removable","sharing","writes"]}}}},"provider":{"description":"The provider type for the splunk package. By default, resources use package-wide configuration\nsettings, however an explicit `Provider` instance may be created and passed during resource\nconstruction to achieve fine-grained programmatic control over provider settings. See the\n[documentation](https://www.pulumi.com/docs/reference/programming-model/#providers) for more information.\n","properties":{"authToken":{"type":"string","description":"Authentication tokens, also known as JSON Web Tokens (JWT), are a method for authenticating Splunk platform users into the Splunk platform"},"insecureSkipVerify":{"type":"boolean","description":"insecure skip verification flag"},"password":{"type":"string","description":"Splunk instance password"},"timeout":{"type":"integer","description":"Timeout when making calls to Splunk server. Defaults to 60 seconds"},"url":{"type":"string","description":"Splunk instance URL"},"username":{"type":"string","description":"Splunk instance admin username"}},"inputProperties":{"authToken":{"type":"string","description":"Authentication tokens, also known as JSON Web Tokens (JWT), are a method for authenticating Splunk platform users into the Splunk platform"},"insecureSkipVerify":{"type":"boolean","description":"insecure skip verification flag"},"password":{"type":"string","description":"Splunk instance password"},"timeout":{"type":"integer","description":"Timeout when making calls to Splunk server. Defaults to 60 seconds"},"url":{"type":"string","description":"Splunk instance URL"},"username":{"type":"string","description":"Splunk instance admin username"}},"methods":{"terraformConfig":"pulumi:providers:splunk/terraformConfig"}},"resources":{"splunk:index/adminSamlGroups:AdminSamlGroups":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.AdminSamlGroups\n\" pulumi-lang-dotnet=\" splunk.AdminSamlGroups\n\" pulumi-lang-go=\" AdminSamlGroups\n\" pulumi-lang-python=\" AdminSamlGroups\n\" pulumi-lang-yaml=\" splunk.AdminSamlGroups\n\" pulumi-lang-java=\" splunk.AdminSamlGroups\n\"\u003e splunk.AdminSamlGroups\n\u003c/span\u003e\nManage external groups in an IdP response to internal Splunk roles.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst saml_group = new splunk.AdminSamlGroups(\"saml-group\", {\n    name: \"mygroup\",\n    roles: [\n        \"admin\",\n        \"power\",\n    ],\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\nsaml_group = splunk.AdminSamlGroups(\"saml-group\",\n    name=\"mygroup\",\n    roles=[\n        \"admin\",\n        \"power\",\n    ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var saml_group = new Splunk.AdminSamlGroups(\"saml-group\", new()\n    {\n        Name = \"mygroup\",\n        Roles = new[]\n        {\n            \"admin\",\n            \"power\",\n        },\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewAdminSamlGroups(ctx, \"saml-group\", \u0026splunk.AdminSamlGroupsArgs{\n\t\t\tName: pulumi.String(\"mygroup\"),\n\t\t\tRoles: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"admin\"),\n\t\t\t\tpulumi.String(\"power\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.AdminSamlGroups;\nimport com.pulumi.splunk.AdminSamlGroupsArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var saml_group = new AdminSamlGroups(\"saml-group\", AdminSamlGroupsArgs.builder()\n            .name(\"mygroup\")\n            .roles(            \n                \"admin\",\n                \"power\")\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  saml-group:\n    type: splunk:AdminSamlGroups\n    properties:\n      name: mygroup\n      roles:\n        - admin\n        - power\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nSAML groups can be imported using the id, e.g.\n\n```sh\n$ pulumi import splunk:index/adminSamlGroups:AdminSamlGroups saml-group mygroup\n```\n\n","properties":{"name":{"type":"string","description":"The name of the external group.\n"},"roles":{"type":"array","items":{"type":"string"},"description":"List of internal roles assigned to the group.\n"}},"required":["name","roles"],"inputProperties":{"name":{"type":"string","description":"The name of the external group.\n","willReplaceOnChanges":true},"roles":{"type":"array","items":{"type":"string"},"description":"List of internal roles assigned to the group.\n"}},"stateInputs":{"description":"Input properties used for looking up and filtering AdminSamlGroups resources.\n","properties":{"name":{"type":"string","description":"The name of the external group.\n","willReplaceOnChanges":true},"roles":{"type":"array","items":{"type":"string"},"description":"List of internal roles assigned to the group.\n"}},"type":"object"}},"splunk:index/appsLocal:AppsLocal":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.AppsLocal\n\" pulumi-lang-dotnet=\" splunk.AppsLocal\n\" pulumi-lang-go=\" AppsLocal\n\" pulumi-lang-python=\" AppsLocal\n\" pulumi-lang-yaml=\" splunk.AppsLocal\n\" pulumi-lang-java=\" splunk.AppsLocal\n\"\u003e splunk.AppsLocal\n\u003c/span\u003e\nCreate, install and manage apps on your Splunk instance\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst amazonConnectApp = new splunk.AppsLocal(\"amazon_connect_app\", {\n    filename: true,\n    name: \"/usr/home/amazon_connect_app_for_splunk-0.0.1.tar.gz\",\n    explicitAppname: \"amazon_connect_app_for_splunk\",\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\namazon_connect_app = splunk.AppsLocal(\"amazon_connect_app\",\n    filename=True,\n    name=\"/usr/home/amazon_connect_app_for_splunk-0.0.1.tar.gz\",\n    explicit_appname=\"amazon_connect_app_for_splunk\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var amazonConnectApp = new Splunk.AppsLocal(\"amazon_connect_app\", new()\n    {\n        Filename = true,\n        Name = \"/usr/home/amazon_connect_app_for_splunk-0.0.1.tar.gz\",\n        ExplicitAppname = \"amazon_connect_app_for_splunk\",\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewAppsLocal(ctx, \"amazon_connect_app\", \u0026splunk.AppsLocalArgs{\n\t\t\tFilename:        pulumi.Bool(true),\n\t\t\tName:            pulumi.String(\"/usr/home/amazon_connect_app_for_splunk-0.0.1.tar.gz\"),\n\t\t\tExplicitAppname: pulumi.String(\"amazon_connect_app_for_splunk\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.AppsLocal;\nimport com.pulumi.splunk.AppsLocalArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var amazonConnectApp = new AppsLocal(\"amazonConnectApp\", AppsLocalArgs.builder()\n            .filename(true)\n            .name(\"/usr/home/amazon_connect_app_for_splunk-0.0.1.tar.gz\")\n            .explicitAppname(\"amazon_connect_app_for_splunk\")\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  amazonConnectApp:\n    type: splunk:AppsLocal\n    name: amazon_connect_app\n    properties:\n      filename: true\n      name: /usr/home/amazon_connect_app_for_splunk-0.0.1.tar.gz\n      explicitAppname: amazon_connect_app_for_splunk\n```\n\u003c!--End PulumiCodeChooser --\u003e\n","properties":{"acl":{"$ref":"#/types/splunk:index/AppsLocalAcl:AppsLocalAcl","description":"The app/user context that is the namespace for the resource\n"},"auth":{"type":"string","description":"Splunkbase session token for operations like install and update that require login. Use auth or session when installing or updating an app through Splunkbase.\n"},"author":{"type":"string","description":"For apps posted to Splunkbase, use your Splunk account username. For internal apps, include your name and contact information.\n"},"configured":{"type":"boolean","description":"Custom setup complete indication:\n\u003cbr\u003etrue = Custom app setup complete.\n\u003cbr\u003efalse = Custom app setup not complete.\n"},"description":{"type":"string","description":"Short app description also displayed below the app title in Splunk Web Launcher.\n"},"explicitAppname":{"type":"string","description":"Custom app name. Overrides name when installing an app from a file where filename is set to true. See also filename.\n"},"filename":{"type":"boolean","description":"Indicates whether to use the name value as the app source location.\n\u003cbr\u003etrue indicates that name is a path to a file to install.\n\u003cbr\u003efalse indicates that name is the literal app name and that the app is created from Splunkbase using a template.\n"},"label":{"type":"string","description":"App name displayed in Splunk Web, from five to eighty characters excluding the prefix \"Splunk for\".\n"},"name":{"type":"string","description":"Literal app name or path for the file to install, depending on the value of filename.\n\u003cbr\u003efilename = false indicates that name is the literal app name and that the app is created from Splunkbase using a template.\n\u003cbr\u003efilename = true indicates that name is the URL or path to the local .tar, .tgz or .spl file. If name is the Splunkbase URL, set auth or session to authenticate the request.\nThe app folder name cannot include spaces or special characters.\n"},"session":{"type":"string","description":"Login session token for installing or updating an app on Splunkbase. Alternatively, use auth.\n"},"update":{"type":"boolean","description":"File-based update indication:\n\u003cbr\u003etrue specifies that filename should be used to update an existing app. If not specified, update defaults to\n\u003cbr\u003efalse, which indicates that filename should not be used to update an existing app.\n"},"version":{"type":"string","description":"App version.\n"},"visible":{"type":"boolean","description":"Indicates whether the app is visible and navigable from Splunk Web.\n\u003cbr\u003etrue = App is visible and navigable.\n\u003cbr\u003efalse = App is not visible or navigable.\n"}},"required":["acl","author","configured","description","label","name","version","visible"],"inputProperties":{"acl":{"$ref":"#/types/splunk:index/AppsLocalAcl:AppsLocalAcl","description":"The app/user context that is the namespace for the resource\n"},"auth":{"type":"string","description":"Splunkbase session token for operations like install and update that require login. Use auth or session when installing or updating an app through Splunkbase.\n"},"author":{"type":"string","description":"For apps posted to Splunkbase, use your Splunk account username. For internal apps, include your name and contact information.\n"},"configured":{"type":"boolean","description":"Custom setup complete indication:\n\u003cbr\u003etrue = Custom app setup complete.\n\u003cbr\u003efalse = Custom app setup not complete.\n"},"description":{"type":"string","description":"Short app description also displayed below the app title in Splunk Web Launcher.\n"},"explicitAppname":{"type":"string","description":"Custom app name. Overrides name when installing an app from a file where filename is set to true. See also filename.\n"},"filename":{"type":"boolean","description":"Indicates whether to use the name value as the app source location.\n\u003cbr\u003etrue indicates that name is a path to a file to install.\n\u003cbr\u003efalse indicates that name is the literal app name and that the app is created from Splunkbase using a template.\n"},"label":{"type":"string","description":"App name displayed in Splunk Web, from five to eighty characters excluding the prefix \"Splunk for\".\n"},"name":{"type":"string","description":"Literal app name or path for the file to install, depending on the value of filename.\n\u003cbr\u003efilename = false indicates that name is the literal app name and that the app is created from Splunkbase using a template.\n\u003cbr\u003efilename = true indicates that name is the URL or path to the local .tar, .tgz or .spl file. If name is the Splunkbase URL, set auth or session to authenticate the request.\nThe app folder name cannot include spaces or special characters.\n"},"session":{"type":"string","description":"Login session token for installing or updating an app on Splunkbase. Alternatively, use auth.\n"},"update":{"type":"boolean","description":"File-based update indication:\n\u003cbr\u003etrue specifies that filename should be used to update an existing app. If not specified, update defaults to\n\u003cbr\u003efalse, which indicates that filename should not be used to update an existing app.\n"},"version":{"type":"string","description":"App version.\n"},"visible":{"type":"boolean","description":"Indicates whether the app is visible and navigable from Splunk Web.\n\u003cbr\u003etrue = App is visible and navigable.\n\u003cbr\u003efalse = App is not visible or navigable.\n"}},"stateInputs":{"description":"Input properties used for looking up and filtering AppsLocal resources.\n","properties":{"acl":{"$ref":"#/types/splunk:index/AppsLocalAcl:AppsLocalAcl","description":"The app/user context that is the namespace for the resource\n"},"auth":{"type":"string","description":"Splunkbase session token for operations like install and update that require login. Use auth or session when installing or updating an app through Splunkbase.\n"},"author":{"type":"string","description":"For apps posted to Splunkbase, use your Splunk account username. For internal apps, include your name and contact information.\n"},"configured":{"type":"boolean","description":"Custom setup complete indication:\n\u003cbr\u003etrue = Custom app setup complete.\n\u003cbr\u003efalse = Custom app setup not complete.\n"},"description":{"type":"string","description":"Short app description also displayed below the app title in Splunk Web Launcher.\n"},"explicitAppname":{"type":"string","description":"Custom app name. Overrides name when installing an app from a file where filename is set to true. See also filename.\n"},"filename":{"type":"boolean","description":"Indicates whether to use the name value as the app source location.\n\u003cbr\u003etrue indicates that name is a path to a file to install.\n\u003cbr\u003efalse indicates that name is the literal app name and that the app is created from Splunkbase using a template.\n"},"label":{"type":"string","description":"App name displayed in Splunk Web, from five to eighty characters excluding the prefix \"Splunk for\".\n"},"name":{"type":"string","description":"Literal app name or path for the file to install, depending on the value of filename.\n\u003cbr\u003efilename = false indicates that name is the literal app name and that the app is created from Splunkbase using a template.\n\u003cbr\u003efilename = true indicates that name is the URL or path to the local .tar, .tgz or .spl file. If name is the Splunkbase URL, set auth or session to authenticate the request.\nThe app folder name cannot include spaces or special characters.\n"},"session":{"type":"string","description":"Login session token for installing or updating an app on Splunkbase. Alternatively, use auth.\n"},"update":{"type":"boolean","description":"File-based update indication:\n\u003cbr\u003etrue specifies that filename should be used to update an existing app. If not specified, update defaults to\n\u003cbr\u003efalse, which indicates that filename should not be used to update an existing app.\n"},"version":{"type":"string","description":"App version.\n"},"visible":{"type":"boolean","description":"Indicates whether the app is visible and navigable from Splunk Web.\n\u003cbr\u003etrue = App is visible and navigable.\n\u003cbr\u003efalse = App is not visible or navigable.\n"}},"type":"object"}},"splunk:index/authenticationUsers:AuthenticationUsers":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.AuthenticationUsers\n\" pulumi-lang-dotnet=\" splunk.AuthenticationUsers\n\" pulumi-lang-go=\" AuthenticationUsers\n\" pulumi-lang-python=\" AuthenticationUsers\n\" pulumi-lang-yaml=\" splunk.AuthenticationUsers\n\" pulumi-lang-java=\" splunk.AuthenticationUsers\n\"\u003e splunk.AuthenticationUsers\n\u003c/span\u003e\nCreate and update user information or delete the user.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst user01 = new splunk.AuthenticationUsers(\"user01\", {\n    name: \"user01\",\n    email: \"user01@example.com\",\n    password: \"password01\",\n    forceChangePass: false,\n    roles: [\"terraform-user01-role\"],\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\nuser01 = splunk.AuthenticationUsers(\"user01\",\n    name=\"user01\",\n    email=\"user01@example.com\",\n    password=\"password01\",\n    force_change_pass=False,\n    roles=[\"terraform-user01-role\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var user01 = new Splunk.AuthenticationUsers(\"user01\", new()\n    {\n        Name = \"user01\",\n        Email = \"user01@example.com\",\n        Password = \"password01\",\n        ForceChangePass = false,\n        Roles = new[]\n        {\n            \"terraform-user01-role\",\n        },\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewAuthenticationUsers(ctx, \"user01\", \u0026splunk.AuthenticationUsersArgs{\n\t\t\tName:            pulumi.String(\"user01\"),\n\t\t\tEmail:           pulumi.String(\"user01@example.com\"),\n\t\t\tPassword:        pulumi.String(\"password01\"),\n\t\t\tForceChangePass: pulumi.Bool(false),\n\t\t\tRoles: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"terraform-user01-role\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.AuthenticationUsers;\nimport com.pulumi.splunk.AuthenticationUsersArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var user01 = new AuthenticationUsers(\"user01\", AuthenticationUsersArgs.builder()\n            .name(\"user01\")\n            .email(\"user01@example.com\")\n            .password(\"password01\")\n            .forceChangePass(false)\n            .roles(\"terraform-user01-role\")\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  user01:\n    type: splunk:AuthenticationUsers\n    properties:\n      name: user01\n      email: user01@example.com\n      password: password01\n      forceChangePass: false\n      roles:\n        - terraform-user01-role\n```\n\u003c!--End PulumiCodeChooser --\u003e\n","properties":{"defaultApp":{"type":"string","description":"User default app. Overrides the default app inherited from the user roles.\n"},"email":{"type":"string","description":"User email address.\n"},"forceChangePass":{"type":"boolean","description":"Force user to change password indication\n"},"name":{"type":"string","description":"Unique user login name.\n"},"password":{"type":"string","description":"User login password.\n","secret":true},"realname":{"type":"string","description":"Full user name.\n"},"restartBackgroundJobs":{"type":"boolean","description":"Restart background search job that has not completed when Splunk restarts indication.\n"},"roles":{"type":"array","items":{"type":"string"},"description":"Role to assign to this user. At least one existing role is required.\n"},"tz":{"type":"string","description":"User timezone.\n"}},"required":["defaultApp","email","name","realname","restartBackgroundJobs","roles","tz"],"inputProperties":{"defaultApp":{"type":"string","description":"User default app. Overrides the default app inherited from the user roles.\n"},"email":{"type":"string","description":"User email address.\n"},"forceChangePass":{"type":"boolean","description":"Force user to change password indication\n"},"name":{"type":"string","description":"Unique user login name.\n","willReplaceOnChanges":true},"password":{"type":"string","description":"User login password.\n","secret":true},"realname":{"type":"string","description":"Full user name.\n"},"restartBackgroundJobs":{"type":"boolean","description":"Restart background search job that has not completed when Splunk restarts indication.\n"},"roles":{"type":"array","items":{"type":"string"},"description":"Role to assign to this user. At least one existing role is required.\n"},"tz":{"type":"string","description":"User timezone.\n"}},"stateInputs":{"description":"Input properties used for looking up and filtering AuthenticationUsers resources.\n","properties":{"defaultApp":{"type":"string","description":"User default app. Overrides the default app inherited from the user roles.\n"},"email":{"type":"string","description":"User email address.\n"},"forceChangePass":{"type":"boolean","description":"Force user to change password indication\n"},"name":{"type":"string","description":"Unique user login name.\n","willReplaceOnChanges":true},"password":{"type":"string","description":"User login password.\n","secret":true},"realname":{"type":"string","description":"Full user name.\n"},"restartBackgroundJobs":{"type":"boolean","description":"Restart background search job that has not completed when Splunk restarts indication.\n"},"roles":{"type":"array","items":{"type":"string"},"description":"Role to assign to this user. At least one existing role is required.\n"},"tz":{"type":"string","description":"User timezone.\n"}},"type":"object"}},"splunk:index/authorizationRoles:AuthorizationRoles":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.AuthorizationRoles\n\" pulumi-lang-dotnet=\" splunk.AuthorizationRoles\n\" pulumi-lang-go=\" AuthorizationRoles\n\" pulumi-lang-python=\" AuthorizationRoles\n\" pulumi-lang-yaml=\" splunk.AuthorizationRoles\n\" pulumi-lang-java=\" splunk.AuthorizationRoles\n\"\u003e splunk.AuthorizationRoles\n\u003c/span\u003e\nCreate and update role information.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst role01 = new splunk.AuthorizationRoles(\"role01\", {\n    name: \"terraform-user01-role\",\n    defaultApp: \"search\",\n    importedRoles: [\n        \"power\",\n        \"user\",\n    ],\n    capabilities: [\n        \"accelerate_datamodel\",\n        \"change_authentication\",\n        \"restart_splunkd\",\n    ],\n    searchIndexesAlloweds: [\n        \"_audit\",\n        \"_internal\",\n        \"main\",\n    ],\n    searchIndexesDefaults: [\n        \"_audit\",\n        \"_internal\",\n        \"main\",\n    ],\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\nrole01 = splunk.AuthorizationRoles(\"role01\",\n    name=\"terraform-user01-role\",\n    default_app=\"search\",\n    imported_roles=[\n        \"power\",\n        \"user\",\n    ],\n    capabilities=[\n        \"accelerate_datamodel\",\n        \"change_authentication\",\n        \"restart_splunkd\",\n    ],\n    search_indexes_alloweds=[\n        \"_audit\",\n        \"_internal\",\n        \"main\",\n    ],\n    search_indexes_defaults=[\n        \"_audit\",\n        \"_internal\",\n        \"main\",\n    ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var role01 = new Splunk.AuthorizationRoles(\"role01\", new()\n    {\n        Name = \"terraform-user01-role\",\n        DefaultApp = \"search\",\n        ImportedRoles = new[]\n        {\n            \"power\",\n            \"user\",\n        },\n        Capabilities = new[]\n        {\n            \"accelerate_datamodel\",\n            \"change_authentication\",\n            \"restart_splunkd\",\n        },\n        SearchIndexesAlloweds = new[]\n        {\n            \"_audit\",\n            \"_internal\",\n            \"main\",\n        },\n        SearchIndexesDefaults = new[]\n        {\n            \"_audit\",\n            \"_internal\",\n            \"main\",\n        },\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewAuthorizationRoles(ctx, \"role01\", \u0026splunk.AuthorizationRolesArgs{\n\t\t\tName:       pulumi.String(\"terraform-user01-role\"),\n\t\t\tDefaultApp: pulumi.String(\"search\"),\n\t\t\tImportedRoles: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"power\"),\n\t\t\t\tpulumi.String(\"user\"),\n\t\t\t},\n\t\t\tCapabilities: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"accelerate_datamodel\"),\n\t\t\t\tpulumi.String(\"change_authentication\"),\n\t\t\t\tpulumi.String(\"restart_splunkd\"),\n\t\t\t},\n\t\t\tSearchIndexesAlloweds: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"_audit\"),\n\t\t\t\tpulumi.String(\"_internal\"),\n\t\t\t\tpulumi.String(\"main\"),\n\t\t\t},\n\t\t\tSearchIndexesDefaults: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"_audit\"),\n\t\t\t\tpulumi.String(\"_internal\"),\n\t\t\t\tpulumi.String(\"main\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.AuthorizationRoles;\nimport com.pulumi.splunk.AuthorizationRolesArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var role01 = new AuthorizationRoles(\"role01\", AuthorizationRolesArgs.builder()\n            .name(\"terraform-user01-role\")\n            .defaultApp(\"search\")\n            .importedRoles(            \n                \"power\",\n                \"user\")\n            .capabilities(            \n                \"accelerate_datamodel\",\n                \"change_authentication\",\n                \"restart_splunkd\")\n            .searchIndexesAlloweds(            \n                \"_audit\",\n                \"_internal\",\n                \"main\")\n            .searchIndexesDefaults(            \n                \"_audit\",\n                \"_internal\",\n                \"main\")\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  role01:\n    type: splunk:AuthorizationRoles\n    properties:\n      name: terraform-user01-role\n      defaultApp: search\n      importedRoles:\n        - power\n        - user\n      capabilities:\n        - accelerate_datamodel\n        - change_authentication\n        - restart_splunkd\n      searchIndexesAlloweds:\n        - _audit\n        - _internal\n        - main\n      searchIndexesDefaults:\n        - _audit\n        - _internal\n        - main\n```\n\u003c!--End PulumiCodeChooser --\u003e\n","properties":{"capabilities":{"type":"array","items":{"type":"string"},"description":"List of capabilities assigned to role.\n"},"cumulativeRealtimeSearchJobsQuota":{"type":"integer","description":"Maximum number of concurrently running real-time searches that all members of this role can have.\n"},"cumulativeSearchJobsQuota":{"type":"integer","description":"Maximum number of concurrently running searches for all role members. Warning message logged when limit is reached.\n"},"defaultApp":{"type":"string","description":"Specify the folder name of the default app to use for this role. A user-specific default app overrides this.\n"},"importedRoles":{"type":"array","items":{"type":"string"},"description":"List of imported roles for this role. \u003cbr\u003eImporting other roles imports all aspects of that role, such as capabilities and allowed indexes to search. In combining multiple roles, the effective value for each attribute is value with the broadest permissions.\n"},"name":{"type":"string","description":"The name of the user role to create.\n"},"realtimeSearchJobsQuota":{"type":"integer","description":"Specify the maximum number of concurrent real-time search jobs for this role. This count is independent from the normal search jobs limit.\n"},"searchDiskQuota":{"type":"integer","description":"Specifies the maximum disk space in MB that can be used by a user's search jobs. For example, a value of 100 limits this role to 100 MB total.\n"},"searchFilter":{"type":"string","description":"Specify a search string that restricts the scope of searches run by this role. Search results for this role only show events that also match the search string you specify. In the case that a user has multiple roles with different search filters, they are combined with an OR.\n"},"searchIndexesAlloweds":{"type":"array","items":{"type":"string"},"description":"List of indexes that this role has permissions to search. These may be wildcarded, but the index name must begin with an underscore to match internal indexes.\n"},"searchIndexesDefaults":{"type":"array","items":{"type":"string"},"description":"List of indexes to search when no index is specified. These indexes can be wildcarded, with the exception that '*' does not match internal indexes. To match internal indexes, start with '_'. All internal indexes are represented by '_*'. A user with this role can search other indexes using \"index= \"\n"},"searchJobsQuota":{"type":"integer","description":"The maximum number of concurrent searches a user with this role is allowed to run. For users with multiple roles, the maximum quota value among all of the roles applies.\n"},"searchTimeWin":{"type":"integer","description":"Maximum time span of a search, in seconds. By default, searches are not limited to any specific time window. To override any search time windows from imported roles, set srchTimeWin to '0', as the 'admin' role does.\n"}},"required":["capabilities","defaultApp","importedRoles","name","searchFilter","searchIndexesAlloweds","searchIndexesDefaults"],"inputProperties":{"capabilities":{"type":"array","items":{"type":"string"},"description":"List of capabilities assigned to role.\n"},"cumulativeRealtimeSearchJobsQuota":{"type":"integer","description":"Maximum number of concurrently running real-time searches that all members of this role can have.\n"},"cumulativeSearchJobsQuota":{"type":"integer","description":"Maximum number of concurrently running searches for all role members. Warning message logged when limit is reached.\n"},"defaultApp":{"type":"string","description":"Specify the folder name of the default app to use for this role. A user-specific default app overrides this.\n"},"importedRoles":{"type":"array","items":{"type":"string"},"description":"List of imported roles for this role. \u003cbr\u003eImporting other roles imports all aspects of that role, such as capabilities and allowed indexes to search. In combining multiple roles, the effective value for each attribute is value with the broadest permissions.\n"},"name":{"type":"string","description":"The name of the user role to create.\n","willReplaceOnChanges":true},"realtimeSearchJobsQuota":{"type":"integer","description":"Specify the maximum number of concurrent real-time search jobs for this role. This count is independent from the normal search jobs limit.\n"},"searchDiskQuota":{"type":"integer","description":"Specifies the maximum disk space in MB that can be used by a user's search jobs. For example, a value of 100 limits this role to 100 MB total.\n"},"searchFilter":{"type":"string","description":"Specify a search string that restricts the scope of searches run by this role. Search results for this role only show events that also match the search string you specify. In the case that a user has multiple roles with different search filters, they are combined with an OR.\n"},"searchIndexesAlloweds":{"type":"array","items":{"type":"string"},"description":"List of indexes that this role has permissions to search. These may be wildcarded, but the index name must begin with an underscore to match internal indexes.\n"},"searchIndexesDefaults":{"type":"array","items":{"type":"string"},"description":"List of indexes to search when no index is specified. These indexes can be wildcarded, with the exception that '*' does not match internal indexes. To match internal indexes, start with '_'. All internal indexes are represented by '_*'. A user with this role can search other indexes using \"index= \"\n"},"searchJobsQuota":{"type":"integer","description":"The maximum number of concurrent searches a user with this role is allowed to run. For users with multiple roles, the maximum quota value among all of the roles applies.\n"},"searchTimeWin":{"type":"integer","description":"Maximum time span of a search, in seconds. By default, searches are not limited to any specific time window. To override any search time windows from imported roles, set srchTimeWin to '0', as the 'admin' role does.\n"}},"stateInputs":{"description":"Input properties used for looking up and filtering AuthorizationRoles resources.\n","properties":{"capabilities":{"type":"array","items":{"type":"string"},"description":"List of capabilities assigned to role.\n"},"cumulativeRealtimeSearchJobsQuota":{"type":"integer","description":"Maximum number of concurrently running real-time searches that all members of this role can have.\n"},"cumulativeSearchJobsQuota":{"type":"integer","description":"Maximum number of concurrently running searches for all role members. Warning message logged when limit is reached.\n"},"defaultApp":{"type":"string","description":"Specify the folder name of the default app to use for this role. A user-specific default app overrides this.\n"},"importedRoles":{"type":"array","items":{"type":"string"},"description":"List of imported roles for this role. \u003cbr\u003eImporting other roles imports all aspects of that role, such as capabilities and allowed indexes to search. In combining multiple roles, the effective value for each attribute is value with the broadest permissions.\n"},"name":{"type":"string","description":"The name of the user role to create.\n","willReplaceOnChanges":true},"realtimeSearchJobsQuota":{"type":"integer","description":"Specify the maximum number of concurrent real-time search jobs for this role. This count is independent from the normal search jobs limit.\n"},"searchDiskQuota":{"type":"integer","description":"Specifies the maximum disk space in MB that can be used by a user's search jobs. For example, a value of 100 limits this role to 100 MB total.\n"},"searchFilter":{"type":"string","description":"Specify a search string that restricts the scope of searches run by this role. Search results for this role only show events that also match the search string you specify. In the case that a user has multiple roles with different search filters, they are combined with an OR.\n"},"searchIndexesAlloweds":{"type":"array","items":{"type":"string"},"description":"List of indexes that this role has permissions to search. These may be wildcarded, but the index name must begin with an underscore to match internal indexes.\n"},"searchIndexesDefaults":{"type":"array","items":{"type":"string"},"description":"List of indexes to search when no index is specified. These indexes can be wildcarded, with the exception that '*' does not match internal indexes. To match internal indexes, start with '_'. All internal indexes are represented by '_*'. A user with this role can search other indexes using \"index= \"\n"},"searchJobsQuota":{"type":"integer","description":"The maximum number of concurrent searches a user with this role is allowed to run. For users with multiple roles, the maximum quota value among all of the roles applies.\n"},"searchTimeWin":{"type":"integer","description":"Maximum time span of a search, in seconds. By default, searches are not limited to any specific time window. To override any search time windows from imported roles, set srchTimeWin to '0', as the 'admin' role does.\n"}},"type":"object"}},"splunk:index/configsConf:ConfigsConf":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.ConfigsConf\n\" pulumi-lang-dotnet=\" splunk.ConfigsConf\n\" pulumi-lang-go=\" ConfigsConf\n\" pulumi-lang-python=\" ConfigsConf\n\" pulumi-lang-yaml=\" splunk.ConfigsConf\n\" pulumi-lang-java=\" splunk.ConfigsConf\n\"\u003e splunk.ConfigsConf\n\u003c/span\u003e\nCreate and manage configuration file stanzas.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst new_conf_stanza = new splunk.ConfigsConf(\"new-conf-stanza\", {\n    name: \"custom-conf/custom\",\n    variables: {\n        disabled: \"false\",\n        custom_key: \"value\",\n    },\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\nnew_conf_stanza = splunk.ConfigsConf(\"new-conf-stanza\",\n    name=\"custom-conf/custom\",\n    variables={\n        \"disabled\": \"false\",\n        \"custom_key\": \"value\",\n    })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var new_conf_stanza = new Splunk.ConfigsConf(\"new-conf-stanza\", new()\n    {\n        Name = \"custom-conf/custom\",\n        Variables = \n        {\n            { \"disabled\", \"false\" },\n            { \"custom_key\", \"value\" },\n        },\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewConfigsConf(ctx, \"new-conf-stanza\", \u0026splunk.ConfigsConfArgs{\n\t\t\tName: pulumi.String(\"custom-conf/custom\"),\n\t\t\tVariables: pulumi.StringMap{\n\t\t\t\t\"disabled\":   pulumi.String(\"false\"),\n\t\t\t\t\"custom_key\": pulumi.String(\"value\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.ConfigsConf;\nimport com.pulumi.splunk.ConfigsConfArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var new_conf_stanza = new ConfigsConf(\"new-conf-stanza\", ConfigsConfArgs.builder()\n            .name(\"custom-conf/custom\")\n            .variables(Map.ofEntries(\n                Map.entry(\"disabled\", \"false\"),\n                Map.entry(\"custom_key\", \"value\")\n            ))\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  new-conf-stanza:\n    type: splunk:ConfigsConf\n    properties:\n      name: custom-conf/custom\n      variables:\n        disabled: 'false'\n        custom_key: value\n```\n\u003c!--End PulumiCodeChooser --\u003e\n","properties":{"acl":{"$ref":"#/types/splunk:index/ConfigsConfAcl:ConfigsConfAcl"},"name":{"type":"string","description":"A '/' separated string consisting of {conf_file_name}/{stanza_name} ex. props/custom_stanza\n"},"variables":{"type":"object","additionalProperties":{"type":"string"},"description":"A map of key value pairs for a stanza.\n"}},"required":["acl","name","variables"],"inputProperties":{"acl":{"$ref":"#/types/splunk:index/ConfigsConfAcl:ConfigsConfAcl"},"name":{"type":"string","description":"A '/' separated string consisting of {conf_file_name}/{stanza_name} ex. props/custom_stanza\n","willReplaceOnChanges":true},"variables":{"type":"object","additionalProperties":{"type":"string"},"description":"A map of key value pairs for a stanza.\n"}},"stateInputs":{"description":"Input properties used for looking up and filtering ConfigsConf resources.\n","properties":{"acl":{"$ref":"#/types/splunk:index/ConfigsConfAcl:ConfigsConfAcl"},"name":{"type":"string","description":"A '/' separated string consisting of {conf_file_name}/{stanza_name} ex. props/custom_stanza\n","willReplaceOnChanges":true},"variables":{"type":"object","additionalProperties":{"type":"string"},"description":"A map of key value pairs for a stanza.\n"}},"type":"object"}},"splunk:index/dataUiViews:DataUiViews":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.DataUiViews\n\" pulumi-lang-dotnet=\" splunk.DataUiViews\n\" pulumi-lang-go=\" DataUiViews\n\" pulumi-lang-python=\" DataUiViews\n\" pulumi-lang-yaml=\" splunk.DataUiViews\n\" pulumi-lang-java=\" splunk.DataUiViews\n\"\u003e splunk.DataUiViews\n\u003c/span\u003e\nCreate and manage splunk dashboards/views.\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst dashboard = new splunk.DataUiViews(\"dashboard\", {\n    name: \"Terraform_Sample_Dashboard\",\n    eaiData: \"\u003cdashboard version=\\\"1.1\\\"\u003e\u003clabel\u003eTerraform\u003c/label\u003e\u003cdescription\u003eTerraform operations\u003c/description\u003e\u003crow\u003e\u003cpanel\u003e\u003cchart\u003e\u003csearch\u003e\u003cquery\u003eindex=_internal sourcetype=splunkd_access useragent=\\\"splunk-simple-go-client\\\" | timechart fixedrange=f values(status) by uri_path\u003c/query\u003e\u003cearliest\u003e-24h@h\u003c/earliest\u003e\u003clatest\u003enow\u003c/latest\u003e\u003csampleRatio\u003e1\u003c/sampleRatio\u003e\u003c/search\u003e\u003coption name=\\\"charting.axisLabelsX.majorLabelStyle.overflowMode\\\"\u003eellipsisNone\u003c/option\u003e\u003coption name=\\\"charting.axisLabelsX.majorLabelStyle.rotation\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"charting.axisTitleX.visibility\\\"\u003ecollapsed\u003c/option\u003e\u003coption name=\\\"charting.axisTitleY.text\\\"\u003eHTTP status codes\u003c/option\u003e\u003coption name=\\\"charting.axisTitleY.visibility\\\"\u003evisible\u003c/option\u003e\u003coption name=\\\"charting.axisTitleY2.visibility\\\"\u003evisible\u003c/option\u003e\u003coption name=\\\"charting.axisX.abbreviation\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.axisX.scale\\\"\u003elinear\u003c/option\u003e\u003coption name=\\\"charting.axisY.abbreviation\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.axisY.scale\\\"\u003elinear\u003c/option\u003e\u003coption name=\\\"charting.axisY2.abbreviation\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.axisY2.enabled\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"charting.axisY2.scale\\\"\u003einherit\u003c/option\u003e\u003coption name=\\\"charting.chart\\\"\u003ecolumn\u003c/option\u003e\u003coption name=\\\"charting.chart.bubbleMaximumSize\\\"\u003e50\u003c/option\u003e\u003coption name=\\\"charting.chart.bubbleMinimumSize\\\"\u003e10\u003c/option\u003e\u003coption name=\\\"charting.chart.bubbleSizeBy\\\"\u003earea\u003c/option\u003e\u003coption name=\\\"charting.chart.nullValueMode\\\"\u003econnect\u003c/option\u003e\u003coption name=\\\"charting.chart.showDataLabels\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.chart.sliceCollapsingThreshold\\\"\u003e0.01\u003c/option\u003e\u003coption name=\\\"charting.chart.stackMode\\\"\u003edefault\u003c/option\u003e\u003coption name=\\\"charting.chart.style\\\"\u003eshiny\u003c/option\u003e\u003coption name=\\\"charting.drilldown\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.layout.splitSeries\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"charting.layout.splitSeries.allowIndependentYRanges\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"charting.legend.labelStyle.overflowMode\\\"\u003eellipsisMiddle\u003c/option\u003e\u003coption name=\\\"charting.legend.mode\\\"\u003estandard\u003c/option\u003e\u003coption name=\\\"charting.legend.placement\\\"\u003eright\u003c/option\u003e\u003coption name=\\\"charting.lineWidth\\\"\u003e2\u003c/option\u003e\u003coption name=\\\"trellis.enabled\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"trellis.scales.shared\\\"\u003e1\u003c/option\u003e\u003coption name=\\\"trellis.size\\\"\u003esmall\u003c/option\u003e\u003coption name=\\\"trellis.splitBy\\\"\u003e_aggregation\u003c/option\u003e\u003c/chart\u003e\u003c/panel\u003e\u003c/row\u003e\u003c/dashboard\u003e\",\n    acl: {\n        owner: \"admin\",\n        app: \"search\",\n    },\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\ndashboard = splunk.DataUiViews(\"dashboard\",\n    name=\"Terraform_Sample_Dashboard\",\n    eai_data=\"\u003cdashboard version=\\\"1.1\\\"\u003e\u003clabel\u003eTerraform\u003c/label\u003e\u003cdescription\u003eTerraform operations\u003c/description\u003e\u003crow\u003e\u003cpanel\u003e\u003cchart\u003e\u003csearch\u003e\u003cquery\u003eindex=_internal sourcetype=splunkd_access useragent=\\\"splunk-simple-go-client\\\" | timechart fixedrange=f values(status) by uri_path\u003c/query\u003e\u003cearliest\u003e-24h@h\u003c/earliest\u003e\u003clatest\u003enow\u003c/latest\u003e\u003csampleRatio\u003e1\u003c/sampleRatio\u003e\u003c/search\u003e\u003coption name=\\\"charting.axisLabelsX.majorLabelStyle.overflowMode\\\"\u003eellipsisNone\u003c/option\u003e\u003coption name=\\\"charting.axisLabelsX.majorLabelStyle.rotation\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"charting.axisTitleX.visibility\\\"\u003ecollapsed\u003c/option\u003e\u003coption name=\\\"charting.axisTitleY.text\\\"\u003eHTTP status codes\u003c/option\u003e\u003coption name=\\\"charting.axisTitleY.visibility\\\"\u003evisible\u003c/option\u003e\u003coption name=\\\"charting.axisTitleY2.visibility\\\"\u003evisible\u003c/option\u003e\u003coption name=\\\"charting.axisX.abbreviation\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.axisX.scale\\\"\u003elinear\u003c/option\u003e\u003coption name=\\\"charting.axisY.abbreviation\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.axisY.scale\\\"\u003elinear\u003c/option\u003e\u003coption name=\\\"charting.axisY2.abbreviation\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.axisY2.enabled\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"charting.axisY2.scale\\\"\u003einherit\u003c/option\u003e\u003coption name=\\\"charting.chart\\\"\u003ecolumn\u003c/option\u003e\u003coption name=\\\"charting.chart.bubbleMaximumSize\\\"\u003e50\u003c/option\u003e\u003coption name=\\\"charting.chart.bubbleMinimumSize\\\"\u003e10\u003c/option\u003e\u003coption name=\\\"charting.chart.bubbleSizeBy\\\"\u003earea\u003c/option\u003e\u003coption name=\\\"charting.chart.nullValueMode\\\"\u003econnect\u003c/option\u003e\u003coption name=\\\"charting.chart.showDataLabels\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.chart.sliceCollapsingThreshold\\\"\u003e0.01\u003c/option\u003e\u003coption name=\\\"charting.chart.stackMode\\\"\u003edefault\u003c/option\u003e\u003coption name=\\\"charting.chart.style\\\"\u003eshiny\u003c/option\u003e\u003coption name=\\\"charting.drilldown\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.layout.splitSeries\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"charting.layout.splitSeries.allowIndependentYRanges\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"charting.legend.labelStyle.overflowMode\\\"\u003eellipsisMiddle\u003c/option\u003e\u003coption name=\\\"charting.legend.mode\\\"\u003estandard\u003c/option\u003e\u003coption name=\\\"charting.legend.placement\\\"\u003eright\u003c/option\u003e\u003coption name=\\\"charting.lineWidth\\\"\u003e2\u003c/option\u003e\u003coption name=\\\"trellis.enabled\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"trellis.scales.shared\\\"\u003e1\u003c/option\u003e\u003coption name=\\\"trellis.size\\\"\u003esmall\u003c/option\u003e\u003coption name=\\\"trellis.splitBy\\\"\u003e_aggregation\u003c/option\u003e\u003c/chart\u003e\u003c/panel\u003e\u003c/row\u003e\u003c/dashboard\u003e\",\n    acl={\n        \"owner\": \"admin\",\n        \"app\": \"search\",\n    })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var dashboard = new Splunk.DataUiViews(\"dashboard\", new()\n    {\n        Name = \"Terraform_Sample_Dashboard\",\n        EaiData = \"\u003cdashboard version=\\\"1.1\\\"\u003e\u003clabel\u003eTerraform\u003c/label\u003e\u003cdescription\u003eTerraform operations\u003c/description\u003e\u003crow\u003e\u003cpanel\u003e\u003cchart\u003e\u003csearch\u003e\u003cquery\u003eindex=_internal sourcetype=splunkd_access useragent=\\\"splunk-simple-go-client\\\" | timechart fixedrange=f values(status) by uri_path\u003c/query\u003e\u003cearliest\u003e-24h@h\u003c/earliest\u003e\u003clatest\u003enow\u003c/latest\u003e\u003csampleRatio\u003e1\u003c/sampleRatio\u003e\u003c/search\u003e\u003coption name=\\\"charting.axisLabelsX.majorLabelStyle.overflowMode\\\"\u003eellipsisNone\u003c/option\u003e\u003coption name=\\\"charting.axisLabelsX.majorLabelStyle.rotation\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"charting.axisTitleX.visibility\\\"\u003ecollapsed\u003c/option\u003e\u003coption name=\\\"charting.axisTitleY.text\\\"\u003eHTTP status codes\u003c/option\u003e\u003coption name=\\\"charting.axisTitleY.visibility\\\"\u003evisible\u003c/option\u003e\u003coption name=\\\"charting.axisTitleY2.visibility\\\"\u003evisible\u003c/option\u003e\u003coption name=\\\"charting.axisX.abbreviation\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.axisX.scale\\\"\u003elinear\u003c/option\u003e\u003coption name=\\\"charting.axisY.abbreviation\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.axisY.scale\\\"\u003elinear\u003c/option\u003e\u003coption name=\\\"charting.axisY2.abbreviation\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.axisY2.enabled\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"charting.axisY2.scale\\\"\u003einherit\u003c/option\u003e\u003coption name=\\\"charting.chart\\\"\u003ecolumn\u003c/option\u003e\u003coption name=\\\"charting.chart.bubbleMaximumSize\\\"\u003e50\u003c/option\u003e\u003coption name=\\\"charting.chart.bubbleMinimumSize\\\"\u003e10\u003c/option\u003e\u003coption name=\\\"charting.chart.bubbleSizeBy\\\"\u003earea\u003c/option\u003e\u003coption name=\\\"charting.chart.nullValueMode\\\"\u003econnect\u003c/option\u003e\u003coption name=\\\"charting.chart.showDataLabels\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.chart.sliceCollapsingThreshold\\\"\u003e0.01\u003c/option\u003e\u003coption name=\\\"charting.chart.stackMode\\\"\u003edefault\u003c/option\u003e\u003coption name=\\\"charting.chart.style\\\"\u003eshiny\u003c/option\u003e\u003coption name=\\\"charting.drilldown\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.layout.splitSeries\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"charting.layout.splitSeries.allowIndependentYRanges\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"charting.legend.labelStyle.overflowMode\\\"\u003eellipsisMiddle\u003c/option\u003e\u003coption name=\\\"charting.legend.mode\\\"\u003estandard\u003c/option\u003e\u003coption name=\\\"charting.legend.placement\\\"\u003eright\u003c/option\u003e\u003coption name=\\\"charting.lineWidth\\\"\u003e2\u003c/option\u003e\u003coption name=\\\"trellis.enabled\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"trellis.scales.shared\\\"\u003e1\u003c/option\u003e\u003coption name=\\\"trellis.size\\\"\u003esmall\u003c/option\u003e\u003coption name=\\\"trellis.splitBy\\\"\u003e_aggregation\u003c/option\u003e\u003c/chart\u003e\u003c/panel\u003e\u003c/row\u003e\u003c/dashboard\u003e\",\n        Acl = new Splunk.Inputs.DataUiViewsAclArgs\n        {\n            Owner = \"admin\",\n            App = \"search\",\n        },\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewDataUiViews(ctx, \"dashboard\", \u0026splunk.DataUiViewsArgs{\n\t\t\tName:    pulumi.String(\"Terraform_Sample_Dashboard\"),\n\t\t\tEaiData: pulumi.String(\"\u003cdashboard version=\\\"1.1\\\"\u003e\u003clabel\u003eTerraform\u003c/label\u003e\u003cdescription\u003eTerraform operations\u003c/description\u003e\u003crow\u003e\u003cpanel\u003e\u003cchart\u003e\u003csearch\u003e\u003cquery\u003eindex=_internal sourcetype=splunkd_access useragent=\\\"splunk-simple-go-client\\\" | timechart fixedrange=f values(status) by uri_path\u003c/query\u003e\u003cearliest\u003e-24h@h\u003c/earliest\u003e\u003clatest\u003enow\u003c/latest\u003e\u003csampleRatio\u003e1\u003c/sampleRatio\u003e\u003c/search\u003e\u003coption name=\\\"charting.axisLabelsX.majorLabelStyle.overflowMode\\\"\u003eellipsisNone\u003c/option\u003e\u003coption name=\\\"charting.axisLabelsX.majorLabelStyle.rotation\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"charting.axisTitleX.visibility\\\"\u003ecollapsed\u003c/option\u003e\u003coption name=\\\"charting.axisTitleY.text\\\"\u003eHTTP status codes\u003c/option\u003e\u003coption name=\\\"charting.axisTitleY.visibility\\\"\u003evisible\u003c/option\u003e\u003coption name=\\\"charting.axisTitleY2.visibility\\\"\u003evisible\u003c/option\u003e\u003coption name=\\\"charting.axisX.abbreviation\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.axisX.scale\\\"\u003elinear\u003c/option\u003e\u003coption name=\\\"charting.axisY.abbreviation\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.axisY.scale\\\"\u003elinear\u003c/option\u003e\u003coption name=\\\"charting.axisY2.abbreviation\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.axisY2.enabled\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"charting.axisY2.scale\\\"\u003einherit\u003c/option\u003e\u003coption name=\\\"charting.chart\\\"\u003ecolumn\u003c/option\u003e\u003coption name=\\\"charting.chart.bubbleMaximumSize\\\"\u003e50\u003c/option\u003e\u003coption name=\\\"charting.chart.bubbleMinimumSize\\\"\u003e10\u003c/option\u003e\u003coption name=\\\"charting.chart.bubbleSizeBy\\\"\u003earea\u003c/option\u003e\u003coption name=\\\"charting.chart.nullValueMode\\\"\u003econnect\u003c/option\u003e\u003coption name=\\\"charting.chart.showDataLabels\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.chart.sliceCollapsingThreshold\\\"\u003e0.01\u003c/option\u003e\u003coption name=\\\"charting.chart.stackMode\\\"\u003edefault\u003c/option\u003e\u003coption name=\\\"charting.chart.style\\\"\u003eshiny\u003c/option\u003e\u003coption name=\\\"charting.drilldown\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.layout.splitSeries\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"charting.layout.splitSeries.allowIndependentYRanges\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"charting.legend.labelStyle.overflowMode\\\"\u003eellipsisMiddle\u003c/option\u003e\u003coption name=\\\"charting.legend.mode\\\"\u003estandard\u003c/option\u003e\u003coption name=\\\"charting.legend.placement\\\"\u003eright\u003c/option\u003e\u003coption name=\\\"charting.lineWidth\\\"\u003e2\u003c/option\u003e\u003coption name=\\\"trellis.enabled\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"trellis.scales.shared\\\"\u003e1\u003c/option\u003e\u003coption name=\\\"trellis.size\\\"\u003esmall\u003c/option\u003e\u003coption name=\\\"trellis.splitBy\\\"\u003e_aggregation\u003c/option\u003e\u003c/chart\u003e\u003c/panel\u003e\u003c/row\u003e\u003c/dashboard\u003e\"),\n\t\t\tAcl: \u0026splunk.DataUiViewsAclArgs{\n\t\t\t\tOwner: pulumi.String(\"admin\"),\n\t\t\t\tApp:   pulumi.String(\"search\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.DataUiViews;\nimport com.pulumi.splunk.DataUiViewsArgs;\nimport com.pulumi.splunk.inputs.DataUiViewsAclArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var dashboard = new DataUiViews(\"dashboard\", DataUiViewsArgs.builder()\n            .name(\"Terraform_Sample_Dashboard\")\n            .eaiData(\"\u003cdashboard version=\\\"1.1\\\"\u003e\u003clabel\u003eTerraform\u003c/label\u003e\u003cdescription\u003eTerraform operations\u003c/description\u003e\u003crow\u003e\u003cpanel\u003e\u003cchart\u003e\u003csearch\u003e\u003cquery\u003eindex=_internal sourcetype=splunkd_access useragent=\\\"splunk-simple-go-client\\\" | timechart fixedrange=f values(status) by uri_path\u003c/query\u003e\u003cearliest\u003e-24h@h\u003c/earliest\u003e\u003clatest\u003enow\u003c/latest\u003e\u003csampleRatio\u003e1\u003c/sampleRatio\u003e\u003c/search\u003e\u003coption name=\\\"charting.axisLabelsX.majorLabelStyle.overflowMode\\\"\u003eellipsisNone\u003c/option\u003e\u003coption name=\\\"charting.axisLabelsX.majorLabelStyle.rotation\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"charting.axisTitleX.visibility\\\"\u003ecollapsed\u003c/option\u003e\u003coption name=\\\"charting.axisTitleY.text\\\"\u003eHTTP status codes\u003c/option\u003e\u003coption name=\\\"charting.axisTitleY.visibility\\\"\u003evisible\u003c/option\u003e\u003coption name=\\\"charting.axisTitleY2.visibility\\\"\u003evisible\u003c/option\u003e\u003coption name=\\\"charting.axisX.abbreviation\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.axisX.scale\\\"\u003elinear\u003c/option\u003e\u003coption name=\\\"charting.axisY.abbreviation\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.axisY.scale\\\"\u003elinear\u003c/option\u003e\u003coption name=\\\"charting.axisY2.abbreviation\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.axisY2.enabled\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"charting.axisY2.scale\\\"\u003einherit\u003c/option\u003e\u003coption name=\\\"charting.chart\\\"\u003ecolumn\u003c/option\u003e\u003coption name=\\\"charting.chart.bubbleMaximumSize\\\"\u003e50\u003c/option\u003e\u003coption name=\\\"charting.chart.bubbleMinimumSize\\\"\u003e10\u003c/option\u003e\u003coption name=\\\"charting.chart.bubbleSizeBy\\\"\u003earea\u003c/option\u003e\u003coption name=\\\"charting.chart.nullValueMode\\\"\u003econnect\u003c/option\u003e\u003coption name=\\\"charting.chart.showDataLabels\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.chart.sliceCollapsingThreshold\\\"\u003e0.01\u003c/option\u003e\u003coption name=\\\"charting.chart.stackMode\\\"\u003edefault\u003c/option\u003e\u003coption name=\\\"charting.chart.style\\\"\u003eshiny\u003c/option\u003e\u003coption name=\\\"charting.drilldown\\\"\u003enone\u003c/option\u003e\u003coption name=\\\"charting.layout.splitSeries\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"charting.layout.splitSeries.allowIndependentYRanges\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"charting.legend.labelStyle.overflowMode\\\"\u003eellipsisMiddle\u003c/option\u003e\u003coption name=\\\"charting.legend.mode\\\"\u003estandard\u003c/option\u003e\u003coption name=\\\"charting.legend.placement\\\"\u003eright\u003c/option\u003e\u003coption name=\\\"charting.lineWidth\\\"\u003e2\u003c/option\u003e\u003coption name=\\\"trellis.enabled\\\"\u003e0\u003c/option\u003e\u003coption name=\\\"trellis.scales.shared\\\"\u003e1\u003c/option\u003e\u003coption name=\\\"trellis.size\\\"\u003esmall\u003c/option\u003e\u003coption name=\\\"trellis.splitBy\\\"\u003e_aggregation\u003c/option\u003e\u003c/chart\u003e\u003c/panel\u003e\u003c/row\u003e\u003c/dashboard\u003e\")\n            .acl(DataUiViewsAclArgs.builder()\n                .owner(\"admin\")\n                .app(\"search\")\n                .build())\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  dashboard:\n    type: splunk:DataUiViews\n    properties:\n      name: Terraform_Sample_Dashboard\n      eaiData: \u003cdashboard version=\"1.1\"\u003e\u003clabel\u003eTerraform\u003c/label\u003e\u003cdescription\u003eTerraform operations\u003c/description\u003e\u003crow\u003e\u003cpanel\u003e\u003cchart\u003e\u003csearch\u003e\u003cquery\u003eindex=_internal sourcetype=splunkd_access useragent=\"splunk-simple-go-client\" | timechart fixedrange=f values(status) by uri_path\u003c/query\u003e\u003cearliest\u003e-24h@h\u003c/earliest\u003e\u003clatest\u003enow\u003c/latest\u003e\u003csampleRatio\u003e1\u003c/sampleRatio\u003e\u003c/search\u003e\u003coption name=\"charting.axisLabelsX.majorLabelStyle.overflowMode\"\u003eellipsisNone\u003c/option\u003e\u003coption name=\"charting.axisLabelsX.majorLabelStyle.rotation\"\u003e0\u003c/option\u003e\u003coption name=\"charting.axisTitleX.visibility\"\u003ecollapsed\u003c/option\u003e\u003coption name=\"charting.axisTitleY.text\"\u003eHTTP status codes\u003c/option\u003e\u003coption name=\"charting.axisTitleY.visibility\"\u003evisible\u003c/option\u003e\u003coption name=\"charting.axisTitleY2.visibility\"\u003evisible\u003c/option\u003e\u003coption name=\"charting.axisX.abbreviation\"\u003enone\u003c/option\u003e\u003coption name=\"charting.axisX.scale\"\u003elinear\u003c/option\u003e\u003coption name=\"charting.axisY.abbreviation\"\u003enone\u003c/option\u003e\u003coption name=\"charting.axisY.scale\"\u003elinear\u003c/option\u003e\u003coption name=\"charting.axisY2.abbreviation\"\u003enone\u003c/option\u003e\u003coption name=\"charting.axisY2.enabled\"\u003e0\u003c/option\u003e\u003coption name=\"charting.axisY2.scale\"\u003einherit\u003c/option\u003e\u003coption name=\"charting.chart\"\u003ecolumn\u003c/option\u003e\u003coption name=\"charting.chart.bubbleMaximumSize\"\u003e50\u003c/option\u003e\u003coption name=\"charting.chart.bubbleMinimumSize\"\u003e10\u003c/option\u003e\u003coption name=\"charting.chart.bubbleSizeBy\"\u003earea\u003c/option\u003e\u003coption name=\"charting.chart.nullValueMode\"\u003econnect\u003c/option\u003e\u003coption name=\"charting.chart.showDataLabels\"\u003enone\u003c/option\u003e\u003coption name=\"charting.chart.sliceCollapsingThreshold\"\u003e0.01\u003c/option\u003e\u003coption name=\"charting.chart.stackMode\"\u003edefault\u003c/option\u003e\u003coption name=\"charting.chart.style\"\u003eshiny\u003c/option\u003e\u003coption name=\"charting.drilldown\"\u003enone\u003c/option\u003e\u003coption name=\"charting.layout.splitSeries\"\u003e0\u003c/option\u003e\u003coption name=\"charting.layout.splitSeries.allowIndependentYRanges\"\u003e0\u003c/option\u003e\u003coption name=\"charting.legend.labelStyle.overflowMode\"\u003eellipsisMiddle\u003c/option\u003e\u003coption name=\"charting.legend.mode\"\u003estandard\u003c/option\u003e\u003coption name=\"charting.legend.placement\"\u003eright\u003c/option\u003e\u003coption name=\"charting.lineWidth\"\u003e2\u003c/option\u003e\u003coption name=\"trellis.enabled\"\u003e0\u003c/option\u003e\u003coption name=\"trellis.scales.shared\"\u003e1\u003c/option\u003e\u003coption name=\"trellis.size\"\u003esmall\u003c/option\u003e\u003coption name=\"trellis.splitBy\"\u003e_aggregation\u003c/option\u003e\u003c/chart\u003e\u003c/panel\u003e\u003c/row\u003e\u003c/dashboard\u003e\n      acl:\n        owner: admin\n        app: search\n```\n\u003c!--End PulumiCodeChooser --\u003e\n","properties":{"acl":{"$ref":"#/types/splunk:index/DataUiViewsAcl:DataUiViewsAcl"},"eaiData":{"type":"string","description":"Dashboard XML definition."},"name":{"type":"string","description":"Dashboard name.\n* `eai:data` - (Required) Dashboard XML definition.\n"}},"required":["acl","eaiData","name"],"inputProperties":{"acl":{"$ref":"#/types/splunk:index/DataUiViewsAcl:DataUiViewsAcl"},"eaiData":{"type":"string","description":"Dashboard XML definition."},"name":{"type":"string","description":"Dashboard name.\n* `eai:data` - (Required) Dashboard XML definition.\n","willReplaceOnChanges":true}},"requiredInputs":["eaiData"],"stateInputs":{"description":"Input properties used for looking up and filtering DataUiViews resources.\n","properties":{"acl":{"$ref":"#/types/splunk:index/DataUiViewsAcl:DataUiViewsAcl"},"eaiData":{"type":"string","description":"Dashboard XML definition."},"name":{"type":"string","description":"Dashboard name.\n* `eai:data` - (Required) Dashboard XML definition.\n","willReplaceOnChanges":true}},"type":"object"}},"splunk:index/genericAcl:GenericAcl":{"description":"## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst myApp = new splunk.GenericAcl(\"my_app\", {\n    path: \"apps/local/my_app\",\n    acl: {\n        app: \"system\",\n        owner: \"nobody\",\n        reads: [\"*\"],\n        writes: [\n            \"admin\",\n            \"power\",\n        ],\n    },\n});\nconst myDashboard = new splunk.GenericAcl(\"my_dashboard\", {\n    path: \"data/ui/views/my_dashboard\",\n    acl: {\n        app: \"my_app\",\n        owner: \"joe_user\",\n        reads: [\"team_joe\"],\n        writes: [\"team_joe\"],\n    },\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\nmy_app = splunk.GenericAcl(\"my_app\",\n    path=\"apps/local/my_app\",\n    acl={\n        \"app\": \"system\",\n        \"owner\": \"nobody\",\n        \"reads\": [\"*\"],\n        \"writes\": [\n            \"admin\",\n            \"power\",\n        ],\n    })\nmy_dashboard = splunk.GenericAcl(\"my_dashboard\",\n    path=\"data/ui/views/my_dashboard\",\n    acl={\n        \"app\": \"my_app\",\n        \"owner\": \"joe_user\",\n        \"reads\": [\"team_joe\"],\n        \"writes\": [\"team_joe\"],\n    })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var myApp = new Splunk.GenericAcl(\"my_app\", new()\n    {\n        Path = \"apps/local/my_app\",\n        Acl = new Splunk.Inputs.GenericAclAclArgs\n        {\n            App = \"system\",\n            Owner = \"nobody\",\n            Reads = new[]\n            {\n                \"*\",\n            },\n            Writes = new[]\n            {\n                \"admin\",\n                \"power\",\n            },\n        },\n    });\n\n    var myDashboard = new Splunk.GenericAcl(\"my_dashboard\", new()\n    {\n        Path = \"data/ui/views/my_dashboard\",\n        Acl = new Splunk.Inputs.GenericAclAclArgs\n        {\n            App = \"my_app\",\n            Owner = \"joe_user\",\n            Reads = new[]\n            {\n                \"team_joe\",\n            },\n            Writes = new[]\n            {\n                \"team_joe\",\n            },\n        },\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewGenericAcl(ctx, \"my_app\", \u0026splunk.GenericAclArgs{\n\t\t\tPath: pulumi.String(\"apps/local/my_app\"),\n\t\t\tAcl: \u0026splunk.GenericAclAclArgs{\n\t\t\t\tApp:   pulumi.String(\"system\"),\n\t\t\t\tOwner: pulumi.String(\"nobody\"),\n\t\t\t\tReads: pulumi.StringArray{\n\t\t\t\t\tpulumi.String(\"*\"),\n\t\t\t\t},\n\t\t\t\tWrites: pulumi.StringArray{\n\t\t\t\t\tpulumi.String(\"admin\"),\n\t\t\t\t\tpulumi.String(\"power\"),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, err = splunk.NewGenericAcl(ctx, \"my_dashboard\", \u0026splunk.GenericAclArgs{\n\t\t\tPath: pulumi.String(\"data/ui/views/my_dashboard\"),\n\t\t\tAcl: \u0026splunk.GenericAclAclArgs{\n\t\t\t\tApp:   pulumi.String(\"my_app\"),\n\t\t\t\tOwner: pulumi.String(\"joe_user\"),\n\t\t\t\tReads: pulumi.StringArray{\n\t\t\t\t\tpulumi.String(\"team_joe\"),\n\t\t\t\t},\n\t\t\t\tWrites: pulumi.StringArray{\n\t\t\t\t\tpulumi.String(\"team_joe\"),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.GenericAcl;\nimport com.pulumi.splunk.GenericAclArgs;\nimport com.pulumi.splunk.inputs.GenericAclAclArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var myApp = new GenericAcl(\"myApp\", GenericAclArgs.builder()\n            .path(\"apps/local/my_app\")\n            .acl(GenericAclAclArgs.builder()\n                .app(\"system\")\n                .owner(\"nobody\")\n                .reads(\"*\")\n                .writes(                \n                    \"admin\",\n                    \"power\")\n                .build())\n            .build());\n\n        var myDashboard = new GenericAcl(\"myDashboard\", GenericAclArgs.builder()\n            .path(\"data/ui/views/my_dashboard\")\n            .acl(GenericAclAclArgs.builder()\n                .app(\"my_app\")\n                .owner(\"joe_user\")\n                .reads(\"team_joe\")\n                .writes(\"team_joe\")\n                .build())\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  myApp:\n    type: splunk:GenericAcl\n    name: my_app\n    properties:\n      path: apps/local/my_app\n      acl:\n        app: system\n        owner: nobody\n        reads:\n          - '*'\n        writes:\n          - admin\n          - power\n  myDashboard:\n    type: splunk:GenericAcl\n    name: my_dashboard\n    properties:\n      path: data/ui/views/my_dashboard\n      acl:\n        app: my_app\n        owner: joe_user\n        reads:\n          - team_joe\n        writes:\n          - team_joe\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nGeneric ACL resources can be imported by specifying their owner, app, and path with a colon-delimited string as the ID:\n\n```sh\n$ pulumi import splunk:index/genericAcl:GenericAcl splunk_generic_acl \u003cowner\u003e:\u003capp\u003e:\u003cpath\u003e\n```\n\n","properties":{"acl":{"$ref":"#/types/splunk:index/GenericAclAcl:GenericAclAcl","description":"The ACL to apply to the object, including app/owner to properly identify the object.\nThough technically optional, it should be explicitly set for this resource to really be valid. Some objects, such as\napps, require specific values for app and owner. Consult the REST API documentation regarding which values to use for\napp and owner for objects that don't fit in the normal namespace.\n"},"path":{"type":"string","description":"REST API Endpoint path to the object, relative to servicesNS/\u003cowner\u003e/\u003capp\u003e\n"}},"required":["acl","path"],"inputProperties":{"acl":{"$ref":"#/types/splunk:index/GenericAclAcl:GenericAclAcl","description":"The ACL to apply to the object, including app/owner to properly identify the object.\nThough technically optional, it should be explicitly set for this resource to really be valid. Some objects, such as\napps, require specific values for app and owner. Consult the REST API documentation regarding which values to use for\napp and owner for objects that don't fit in the normal namespace.\n"},"path":{"type":"string","description":"REST API Endpoint path to the object, relative to servicesNS/\u003cowner\u003e/\u003capp\u003e\n"}},"requiredInputs":["path"],"stateInputs":{"description":"Input properties used for looking up and filtering GenericAcl resources.\n","properties":{"acl":{"$ref":"#/types/splunk:index/GenericAclAcl:GenericAclAcl","description":"The ACL to apply to the object, including app/owner to properly identify the object.\nThough technically optional, it should be explicitly set for this resource to really be valid. Some objects, such as\napps, require specific values for app and owner. Consult the REST API documentation regarding which values to use for\napp and owner for objects that don't fit in the normal namespace.\n"},"path":{"type":"string","description":"REST API Endpoint path to the object, relative to servicesNS/\u003cowner\u003e/\u003capp\u003e\n"}},"type":"object"}},"splunk:index/globalHttpEventCollector:GlobalHttpEventCollector":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.GlobalHttpEventCollector\n\" pulumi-lang-dotnet=\" splunk.GlobalHttpEventCollector\n\" pulumi-lang-go=\" GlobalHttpEventCollector\n\" pulumi-lang-python=\" GlobalHttpEventCollector\n\" pulumi-lang-yaml=\" splunk.GlobalHttpEventCollector\n\" pulumi-lang-java=\" splunk.GlobalHttpEventCollector\n\"\u003e splunk.GlobalHttpEventCollector\n\u003c/span\u003e\nUpdate Global HTTP Event Collector input configuration.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst http = new splunk.GlobalHttpEventCollector(\"http\", {\n    disabled: false,\n    enableSsl: true,\n    port: 8088,\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\nhttp = splunk.GlobalHttpEventCollector(\"http\",\n    disabled=False,\n    enable_ssl=True,\n    port=8088)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var http = new Splunk.GlobalHttpEventCollector(\"http\", new()\n    {\n        Disabled = false,\n        EnableSsl = true,\n        Port = 8088,\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewGlobalHttpEventCollector(ctx, \"http\", \u0026splunk.GlobalHttpEventCollectorArgs{\n\t\t\tDisabled:  pulumi.Bool(false),\n\t\t\tEnableSsl: pulumi.Bool(true),\n\t\t\tPort:      pulumi.Int(8088),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.GlobalHttpEventCollector;\nimport com.pulumi.splunk.GlobalHttpEventCollectorArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var http = new GlobalHttpEventCollector(\"http\", GlobalHttpEventCollectorArgs.builder()\n            .disabled(false)\n            .enableSsl(true)\n            .port(8088)\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  http:\n    type: splunk:GlobalHttpEventCollector\n    properties:\n      disabled: false\n      enableSsl: true\n      port: 8088\n```\n\u003c!--End PulumiCodeChooser --\u003e\n","properties":{"dedicatedIoThreads":{"type":"integer","description":"Number of threads used by HTTP Input server.\n"},"disabled":{"type":"boolean","description":"Input disabled indicator.\n"},"enableSsl":{"type":"boolean","description":"Enable SSL protocol for HTTP data input. \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\"\u003e`true`\u003c/span\u003e = SSL enabled, \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\"\u003e`false`\u003c/span\u003e = SSL disabled.\n"},"maxSockets":{"type":"integer","description":"Maximum number of simultaneous HTTP connections accepted. Adjusting this value may cause server performance issues and is not generally recommended. Possible values for this setting vary by OS.\n"},"maxThreads":{"type":"integer","description":"Maximum number of threads that can be used by active HTTP transactions. Adjusting this value may cause server performance issues and is not generally recommended. Possible values for this setting vary by OS.\n"},"port":{"type":"integer","description":"HTTP data input IP port.\n"},"useDeploymentServer":{"type":"integer","description":"Indicates whether the event collector input writes its configuration to a deployment server repository. When this setting is set to 1 (enabled), the input writes its configuration to the directory specified as repositoryLocation in serverclass.conf.\nCopy the full contents of the\u003cspan pulumi-lang-nodejs=\" splunkHttpinput \" pulumi-lang-dotnet=\" SplunkHttpinput \" pulumi-lang-go=\" splunkHttpinput \" pulumi-lang-python=\" splunk_httpinput \" pulumi-lang-yaml=\" splunkHttpinput \" pulumi-lang-java=\" splunkHttpinput \"\u003e splunk_httpinput \u003c/span\u003eapp directory to this directory for the configuration to work. When enabled, only the tokens defined in the\u003cspan pulumi-lang-nodejs=\" splunkHttpinput \" pulumi-lang-dotnet=\" SplunkHttpinput \" pulumi-lang-go=\" splunkHttpinput \" pulumi-lang-python=\" splunk_httpinput \" pulumi-lang-yaml=\" splunkHttpinput \" pulumi-lang-java=\" splunkHttpinput \"\u003e splunk_httpinput \u003c/span\u003eapp in this repository are viewable and editable on the API and the Data Inputs page in Splunk Web. When disabled, the input writes its configuration to $SPLUNK_HOME/etc/apps by default. Defaults to 0 (disabled).\n"}},"required":["dedicatedIoThreads","disabled","enableSsl","maxSockets","maxThreads","port","useDeploymentServer"],"inputProperties":{"dedicatedIoThreads":{"type":"integer","description":"Number of threads used by HTTP Input server.\n"},"disabled":{"type":"boolean","description":"Input disabled indicator.\n"},"enableSsl":{"type":"boolean","description":"Enable SSL protocol for HTTP data input. \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\"\u003e`true`\u003c/span\u003e = SSL enabled, \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\"\u003e`false`\u003c/span\u003e = SSL disabled.\n"},"maxSockets":{"type":"integer","description":"Maximum number of simultaneous HTTP connections accepted. Adjusting this value may cause server performance issues and is not generally recommended. Possible values for this setting vary by OS.\n"},"maxThreads":{"type":"integer","description":"Maximum number of threads that can be used by active HTTP transactions. Adjusting this value may cause server performance issues and is not generally recommended. Possible values for this setting vary by OS.\n"},"port":{"type":"integer","description":"HTTP data input IP port.\n"},"useDeploymentServer":{"type":"integer","description":"Indicates whether the event collector input writes its configuration to a deployment server repository. When this setting is set to 1 (enabled), the input writes its configuration to the directory specified as repositoryLocation in serverclass.conf.\nCopy the full contents of the\u003cspan pulumi-lang-nodejs=\" splunkHttpinput \" pulumi-lang-dotnet=\" SplunkHttpinput \" pulumi-lang-go=\" splunkHttpinput \" pulumi-lang-python=\" splunk_httpinput \" pulumi-lang-yaml=\" splunkHttpinput \" pulumi-lang-java=\" splunkHttpinput \"\u003e splunk_httpinput \u003c/span\u003eapp directory to this directory for the configuration to work. When enabled, only the tokens defined in the\u003cspan pulumi-lang-nodejs=\" splunkHttpinput \" pulumi-lang-dotnet=\" SplunkHttpinput \" pulumi-lang-go=\" splunkHttpinput \" pulumi-lang-python=\" splunk_httpinput \" pulumi-lang-yaml=\" splunkHttpinput \" pulumi-lang-java=\" splunkHttpinput \"\u003e splunk_httpinput \u003c/span\u003eapp in this repository are viewable and editable on the API and the Data Inputs page in Splunk Web. When disabled, the input writes its configuration to $SPLUNK_HOME/etc/apps by default. Defaults to 0 (disabled).\n"}},"stateInputs":{"description":"Input properties used for looking up and filtering GlobalHttpEventCollector resources.\n","properties":{"dedicatedIoThreads":{"type":"integer","description":"Number of threads used by HTTP Input server.\n"},"disabled":{"type":"boolean","description":"Input disabled indicator.\n"},"enableSsl":{"type":"boolean","description":"Enable SSL protocol for HTTP data input. \u003cspan pulumi-lang-nodejs=\"`true`\" pulumi-lang-dotnet=\"`True`\" pulumi-lang-go=\"`true`\" pulumi-lang-python=\"`true`\" pulumi-lang-yaml=\"`true`\" pulumi-lang-java=\"`true`\"\u003e`true`\u003c/span\u003e = SSL enabled, \u003cspan pulumi-lang-nodejs=\"`false`\" pulumi-lang-dotnet=\"`False`\" pulumi-lang-go=\"`false`\" pulumi-lang-python=\"`false`\" pulumi-lang-yaml=\"`false`\" pulumi-lang-java=\"`false`\"\u003e`false`\u003c/span\u003e = SSL disabled.\n"},"maxSockets":{"type":"integer","description":"Maximum number of simultaneous HTTP connections accepted. Adjusting this value may cause server performance issues and is not generally recommended. Possible values for this setting vary by OS.\n"},"maxThreads":{"type":"integer","description":"Maximum number of threads that can be used by active HTTP transactions. Adjusting this value may cause server performance issues and is not generally recommended. Possible values for this setting vary by OS.\n"},"port":{"type":"integer","description":"HTTP data input IP port.\n"},"useDeploymentServer":{"type":"integer","description":"Indicates whether the event collector input writes its configuration to a deployment server repository. When this setting is set to 1 (enabled), the input writes its configuration to the directory specified as repositoryLocation in serverclass.conf.\nCopy the full contents of the\u003cspan pulumi-lang-nodejs=\" splunkHttpinput \" pulumi-lang-dotnet=\" SplunkHttpinput \" pulumi-lang-go=\" splunkHttpinput \" pulumi-lang-python=\" splunk_httpinput \" pulumi-lang-yaml=\" splunkHttpinput \" pulumi-lang-java=\" splunkHttpinput \"\u003e splunk_httpinput \u003c/span\u003eapp directory to this directory for the configuration to work. When enabled, only the tokens defined in the\u003cspan pulumi-lang-nodejs=\" splunkHttpinput \" pulumi-lang-dotnet=\" SplunkHttpinput \" pulumi-lang-go=\" splunkHttpinput \" pulumi-lang-python=\" splunk_httpinput \" pulumi-lang-yaml=\" splunkHttpinput \" pulumi-lang-java=\" splunkHttpinput \"\u003e splunk_httpinput \u003c/span\u003eapp in this repository are viewable and editable on the API and the Data Inputs page in Splunk Web. When disabled, the input writes its configuration to $SPLUNK_HOME/etc/apps by default. Defaults to 0 (disabled).\n"}},"type":"object"}},"splunk:index/indexes:Indexes":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.Indexes\n\" pulumi-lang-dotnet=\" splunk.Indexes\n\" pulumi-lang-go=\" Indexes\n\" pulumi-lang-python=\" Indexes\n\" pulumi-lang-yaml=\" splunk.Indexes\n\" pulumi-lang-java=\" splunk.Indexes\n\"\u003e splunk.Indexes\n\u003c/span\u003e\nCreate and manage data indexes.\n\n## Authorization and authentication\n\nBy default, all users can list all indexes. However, if the\u003cspan pulumi-lang-nodejs=\" indexesListAll \" pulumi-lang-dotnet=\" IndexesListAll \" pulumi-lang-go=\" indexesListAll \" pulumi-lang-python=\" indexes_list_all \" pulumi-lang-yaml=\" indexesListAll \" pulumi-lang-java=\" indexesListAll \"\u003e indexes_list_all \u003c/span\u003ecapability is enabled in authorize.conf, access to all indexes is limited to only those roles with this capability.\nTo enable\u003cspan pulumi-lang-nodejs=\" indexesListAll \" pulumi-lang-dotnet=\" IndexesListAll \" pulumi-lang-go=\" indexesListAll \" pulumi-lang-python=\" indexes_list_all \" pulumi-lang-yaml=\" indexesListAll \" pulumi-lang-java=\" indexesListAll \"\u003e indexes_list_all \u003c/span\u003ecapability restrictions on the data/indexes endpoint, create a [capability::indexes_list_all] stanza in authorize.conf. Specify indexes_list_all=enabled for any role permitted to list all indexes from this endpoint.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst user01_index = new splunk.Indexes(\"user01-index\", {\n    name: \"user01-index\",\n    maxHotBuckets: 6,\n    maxTotalDataSizeMb: 1000000,\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\nuser01_index = splunk.Indexes(\"user01-index\",\n    name=\"user01-index\",\n    max_hot_buckets=6,\n    max_total_data_size_mb=1000000)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var user01_index = new Splunk.Indexes(\"user01-index\", new()\n    {\n        Name = \"user01-index\",\n        MaxHotBuckets = 6,\n        MaxTotalDataSizeMb = 1000000,\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewIndexes(ctx, \"user01-index\", \u0026splunk.IndexesArgs{\n\t\t\tName:               pulumi.String(\"user01-index\"),\n\t\t\tMaxHotBuckets:      pulumi.Int(6),\n\t\t\tMaxTotalDataSizeMb: pulumi.Int(1000000),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.Indexes;\nimport com.pulumi.splunk.IndexesArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var user01_index = new Indexes(\"user01-index\", IndexesArgs.builder()\n            .name(\"user01-index\")\n            .maxHotBuckets(6)\n            .maxTotalDataSizeMb(1000000)\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  user01-index:\n    type: splunk:Indexes\n    properties:\n      name: user01-index\n      maxHotBuckets: 6\n      maxTotalDataSizeMb: 1e+06\n```\n\u003c!--End PulumiCodeChooser --\u003e\n","properties":{"acl":{"$ref":"#/types/splunk:index/IndexesAcl:IndexesAcl","description":"The app/user context that is the namespace for the resource\n"},"blockSignSize":{"type":"integer","description":"Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. \u003cbr\u003eA recommended value is 100.\n"},"bucketRebuildMemoryHint":{"type":"string","description":"Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.\n\u003cbe\u003eCaution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.\nDefault value, auto, varies by the amount of physical RAM on the host\u003cbr\u003e\nless than 2GB RAM = 67108864 (64MB) tsidx\n2GB to 8GB RAM = 134217728 (128MB) tsidx\nmore than 8GB RAM = 268435456 (256MB) tsidx\u003cbr\u003e\nValues other than \"auto\" must be 16MB-1GB. Highest legal value (of the numerical part) is 4294967295 You can specify the value using a size suffix: \"16777216\" or \"16MB\" are equivalent.\n"},"coldPath":{"type":"string","description":"An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.\n"},"coldToFrozenDir":{"type":"string","description":"Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.\n\u003cbr\u003e\nBucket freezing policy is as follows:\u003cbr\u003e\nNew style buckets (4.2 and on): removes all files but the rawdata\u003cbr\u003e\nTo thaw, run splunk rebuild \u003cbucket dir\u003e on the bucket, then move to the thawed directory\u003cbr\u003e\nOld style buckets (Pre-4.2): gzip all the .data and .tsidx files\u003cbr\u003e\nTo thaw, gunzip the zipped files and move the bucket into the thawed directory\u003cbr\u003e\nIf both coldToFrozenDir and coldToFrozenScript are specified, coldToFrozenDir takes precedence\n"},"coldToFrozenScript":{"type":"string","description":"Path to the archiving script.\n\u003cbr\u003eIf your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.\n\u003cbr\u003eSplunk software ships with an example archiving script in $SPLUNK_HOME/bin called coldToFrozenExample.py. DO NOT use this example script directly. It uses a default path, and if modified in place any changes are overwritten on upgrade.\n\u003cbr\u003eIt is best to copy the example script to a new file in bin and modify it for your system. Most importantly, change the default archive path to an existing directory that fits your needs.\n"},"compressRawdata":{"type":"boolean","description":"This parameter is ignored. The splunkd process always compresses raw data.\n"},"datatype":{"type":"string","description":"Valid values: (event | metric). Specifies the type of index.\n"},"enableOnlineBucketRepair":{"type":"boolean","description":"Enables asynchronous \"online fsck\" bucket repair, which runs concurrently with Splunk software.\nWhen enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.\n"},"frozenTimePeriodInSecs":{"type":"integer","description":"Number of seconds after which indexed data rolls to frozen.\nDefaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.\n"},"homePath":{"type":"string","description":"An absolute path that contains the hot and warm buckets for the index.\nRequired. Splunk software does not start if an index lacks a valid homePath.\n\u003cbr\u003eCaution: The path must be readable and writable.\n"},"maxBloomBackfillBucketAge":{"type":"string","description":"Valid values are: Integer[m|s|h|d].\n\u003cbr\u003eIf a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.\n"},"maxConcurrentOptimizes":{"type":"integer","description":"The number of concurrent optimize processes that can run against a hot bucket.\nThis number should be increased if instructed by Splunk Support. Typically the default value should suffice.\n"},"maxDataSize":{"type":"string","description":"The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying \"auto\" or \u003cspan pulumi-lang-nodejs=\"\"autoHighVolume\"\" pulumi-lang-dotnet=\"\"AutoHighVolume\"\" pulumi-lang-go=\"\"autoHighVolume\"\" pulumi-lang-python=\"\"auto_high_volume\"\" pulumi-lang-yaml=\"\"autoHighVolume\"\" pulumi-lang-java=\"\"autoHighVolume\"\"\u003e\"auto_high_volume\"\u003c/span\u003e causes Splunk software to autotune this parameter (recommended).\nUse \u003cspan pulumi-lang-nodejs=\"\"autoHighVolume\"\" pulumi-lang-dotnet=\"\"AutoHighVolume\"\" pulumi-lang-go=\"\"autoHighVolume\"\" pulumi-lang-python=\"\"auto_high_volume\"\" pulumi-lang-yaml=\"\"autoHighVolume\"\" pulumi-lang-java=\"\"autoHighVolume\"\"\u003e\"auto_high_volume\"\u003c/span\u003e for high volume indexes (such as the main index); otherwise, use \"auto\". A \"high volume index\" would typically be considered one that gets over 10GB of data per day.\n"},"maxHotBuckets":{"type":"integer","description":"Maximum hot buckets that can exist per index. Defaults to 3.\n\u003cbr\u003eWhen maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.\n"},"maxHotIdleSecs":{"type":"integer","description":"Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).\n"},"maxHotSpanSecs":{"type":"integer","description":"Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).\n"},"maxMemMb":{"type":"integer","description":"The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.\n"},"maxMetaEntries":{"type":"integer","description":"Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.\n"},"maxTimeUnreplicatedNoAcks":{"type":"integer","description":"Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.\nIf there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.\nHighest legal value is 2147483647. To disable this parameter, set to 0.\n"},"maxTimeUnreplicatedWithAcks":{"type":"integer","description":"Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).\nNote: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.\nTo disable, set to 0, but this is NOT recommended. Highest legal value is 2147483647.\n"},"maxTotalDataSizeMb":{"type":"integer","description":"The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.\n"},"maxWarmDbCount":{"type":"integer","description":"The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.\n"},"minRawFileSyncSecs":{"type":"string","description":"Specify an integer (or \"disable\") for this parameter.\nThis parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.\nDuring this period, uncompressed slices are left on disk even after they are compressed. Then splunkd forces a filesystem sync of the compressed journal and removes the accumulated uncompressed files.\nIf 0 is specified, splunkd forces a filesystem sync after every slice completes compressing. Specifying \"disable\" disables syncing entirely: uncompressed slices are removed as soon as compression is complete.\n"},"minStreamGroupQueueSize":{"type":"integer","description":"Minimum size of the queue that stores events in memory before committing them to a tsidx file.\n"},"name":{"type":"string","description":"The name of the index to create.\n"},"partialServiceMetaPeriod":{"type":"integer","description":"Related to serviceMetaPeriod. If set, it enables metadata sync every \u003cinteger\u003e seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.\npartialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.\nIf the value of partialServiceMetaPeriod is greater than serviceMetaPeriod, this setting has no effect.\nBy default it is turned off (zero).\n"},"processTrackerServiceInterval":{"type":"integer","description":"Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.\nIf set to 0, the indexer checks child process status every second.\nHighest legal value is 4294967295.\n"},"quarantineFutureSecs":{"type":"integer","description":"Events with timestamp of quarantineFutureSecs newer than \"now\" are dropped into quarantine bucket. Defaults to 2592000 (30 days).\nThis is a mechanism to prevent main hot buckets from being polluted with fringe events.\n"},"quarantinePastSecs":{"type":"integer","description":"Events with timestamp of quarantinePastSecs older than \"now\" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.\n"},"rawChunkSizeBytes":{"type":"integer","description":"Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.\n"},"repFactor":{"type":"string","description":"Index replication control. This parameter applies to only clustering slaves.\nauto = Use the master index replication configuration value.\n0 = Turn off replication for this index.\n"},"rotatePeriodInSecs":{"type":"integer","description":"How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.\n"},"serviceMetaPeriod":{"type":"integer","description":"Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).\nYou may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.\n"},"syncMeta":{"type":"boolean","description":"When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.\n"},"thawedPath":{"type":"string","description":"An absolute path that contains the thawed (resurrected) databases for the index.\nCannot be defined in terms of a volume definition.\nRequired. Splunk software does not start if an index lacks a valid thawedPath.\n"},"throttleCheckPeriod":{"type":"integer","description":"Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).\n"},"tstatsHomePath":{"type":"string","description":"Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.\nIf specified, it must be defined in terms of a volume definition.\n"},"warmToColdScript":{"type":"string","description":"Path to a script to run when moving data from warm to cold.\nThis attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.\n"}},"required":["acl","blockSignSize","bucketRebuildMemoryHint","coldPath","coldToFrozenDir","coldToFrozenScript","compressRawdata","datatype","enableOnlineBucketRepair","frozenTimePeriodInSecs","homePath","maxBloomBackfillBucketAge","maxConcurrentOptimizes","maxDataSize","maxHotBuckets","maxHotIdleSecs","maxHotSpanSecs","maxMemMb","maxMetaEntries","maxTimeUnreplicatedNoAcks","maxTimeUnreplicatedWithAcks","maxTotalDataSizeMb","maxWarmDbCount","minRawFileSyncSecs","minStreamGroupQueueSize","name","partialServiceMetaPeriod","processTrackerServiceInterval","quarantineFutureSecs","quarantinePastSecs","rawChunkSizeBytes","repFactor","rotatePeriodInSecs","serviceMetaPeriod","syncMeta","thawedPath","throttleCheckPeriod","tstatsHomePath","warmToColdScript"],"inputProperties":{"acl":{"$ref":"#/types/splunk:index/IndexesAcl:IndexesAcl","description":"The app/user context that is the namespace for the resource\n"},"blockSignSize":{"type":"integer","description":"Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. \u003cbr\u003eA recommended value is 100.\n"},"bucketRebuildMemoryHint":{"type":"string","description":"Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.\n\u003cbe\u003eCaution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.\nDefault value, auto, varies by the amount of physical RAM on the host\u003cbr\u003e\nless than 2GB RAM = 67108864 (64MB) tsidx\n2GB to 8GB RAM = 134217728 (128MB) tsidx\nmore than 8GB RAM = 268435456 (256MB) tsidx\u003cbr\u003e\nValues other than \"auto\" must be 16MB-1GB. Highest legal value (of the numerical part) is 4294967295 You can specify the value using a size suffix: \"16777216\" or \"16MB\" are equivalent.\n"},"coldPath":{"type":"string","description":"An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.\n"},"coldToFrozenDir":{"type":"string","description":"Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.\n\u003cbr\u003e\nBucket freezing policy is as follows:\u003cbr\u003e\nNew style buckets (4.2 and on): removes all files but the rawdata\u003cbr\u003e\nTo thaw, run splunk rebuild \u003cbucket dir\u003e on the bucket, then move to the thawed directory\u003cbr\u003e\nOld style buckets (Pre-4.2): gzip all the .data and .tsidx files\u003cbr\u003e\nTo thaw, gunzip the zipped files and move the bucket into the thawed directory\u003cbr\u003e\nIf both coldToFrozenDir and coldToFrozenScript are specified, coldToFrozenDir takes precedence\n"},"coldToFrozenScript":{"type":"string","description":"Path to the archiving script.\n\u003cbr\u003eIf your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.\n\u003cbr\u003eSplunk software ships with an example archiving script in $SPLUNK_HOME/bin called coldToFrozenExample.py. DO NOT use this example script directly. It uses a default path, and if modified in place any changes are overwritten on upgrade.\n\u003cbr\u003eIt is best to copy the example script to a new file in bin and modify it for your system. Most importantly, change the default archive path to an existing directory that fits your needs.\n"},"compressRawdata":{"type":"boolean","description":"This parameter is ignored. The splunkd process always compresses raw data.\n"},"datatype":{"type":"string","description":"Valid values: (event | metric). Specifies the type of index.\n"},"enableOnlineBucketRepair":{"type":"boolean","description":"Enables asynchronous \"online fsck\" bucket repair, which runs concurrently with Splunk software.\nWhen enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.\n"},"frozenTimePeriodInSecs":{"type":"integer","description":"Number of seconds after which indexed data rolls to frozen.\nDefaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.\n"},"homePath":{"type":"string","description":"An absolute path that contains the hot and warm buckets for the index.\nRequired. Splunk software does not start if an index lacks a valid homePath.\n\u003cbr\u003eCaution: The path must be readable and writable.\n"},"maxBloomBackfillBucketAge":{"type":"string","description":"Valid values are: Integer[m|s|h|d].\n\u003cbr\u003eIf a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.\n"},"maxConcurrentOptimizes":{"type":"integer","description":"The number of concurrent optimize processes that can run against a hot bucket.\nThis number should be increased if instructed by Splunk Support. Typically the default value should suffice.\n"},"maxDataSize":{"type":"string","description":"The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying \"auto\" or \u003cspan pulumi-lang-nodejs=\"\"autoHighVolume\"\" pulumi-lang-dotnet=\"\"AutoHighVolume\"\" pulumi-lang-go=\"\"autoHighVolume\"\" pulumi-lang-python=\"\"auto_high_volume\"\" pulumi-lang-yaml=\"\"autoHighVolume\"\" pulumi-lang-java=\"\"autoHighVolume\"\"\u003e\"auto_high_volume\"\u003c/span\u003e causes Splunk software to autotune this parameter (recommended).\nUse \u003cspan pulumi-lang-nodejs=\"\"autoHighVolume\"\" pulumi-lang-dotnet=\"\"AutoHighVolume\"\" pulumi-lang-go=\"\"autoHighVolume\"\" pulumi-lang-python=\"\"auto_high_volume\"\" pulumi-lang-yaml=\"\"autoHighVolume\"\" pulumi-lang-java=\"\"autoHighVolume\"\"\u003e\"auto_high_volume\"\u003c/span\u003e for high volume indexes (such as the main index); otherwise, use \"auto\". A \"high volume index\" would typically be considered one that gets over 10GB of data per day.\n"},"maxHotBuckets":{"type":"integer","description":"Maximum hot buckets that can exist per index. Defaults to 3.\n\u003cbr\u003eWhen maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.\n"},"maxHotIdleSecs":{"type":"integer","description":"Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).\n"},"maxHotSpanSecs":{"type":"integer","description":"Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).\n"},"maxMemMb":{"type":"integer","description":"The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.\n"},"maxMetaEntries":{"type":"integer","description":"Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.\n"},"maxTimeUnreplicatedNoAcks":{"type":"integer","description":"Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.\nIf there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.\nHighest legal value is 2147483647. To disable this parameter, set to 0.\n"},"maxTimeUnreplicatedWithAcks":{"type":"integer","description":"Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).\nNote: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.\nTo disable, set to 0, but this is NOT recommended. Highest legal value is 2147483647.\n"},"maxTotalDataSizeMb":{"type":"integer","description":"The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.\n"},"maxWarmDbCount":{"type":"integer","description":"The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.\n"},"minRawFileSyncSecs":{"type":"string","description":"Specify an integer (or \"disable\") for this parameter.\nThis parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.\nDuring this period, uncompressed slices are left on disk even after they are compressed. Then splunkd forces a filesystem sync of the compressed journal and removes the accumulated uncompressed files.\nIf 0 is specified, splunkd forces a filesystem sync after every slice completes compressing. Specifying \"disable\" disables syncing entirely: uncompressed slices are removed as soon as compression is complete.\n"},"minStreamGroupQueueSize":{"type":"integer","description":"Minimum size of the queue that stores events in memory before committing them to a tsidx file.\n"},"name":{"type":"string","description":"The name of the index to create.\n","willReplaceOnChanges":true},"partialServiceMetaPeriod":{"type":"integer","description":"Related to serviceMetaPeriod. If set, it enables metadata sync every \u003cinteger\u003e seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.\npartialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.\nIf the value of partialServiceMetaPeriod is greater than serviceMetaPeriod, this setting has no effect.\nBy default it is turned off (zero).\n"},"processTrackerServiceInterval":{"type":"integer","description":"Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.\nIf set to 0, the indexer checks child process status every second.\nHighest legal value is 4294967295.\n"},"quarantineFutureSecs":{"type":"integer","description":"Events with timestamp of quarantineFutureSecs newer than \"now\" are dropped into quarantine bucket. Defaults to 2592000 (30 days).\nThis is a mechanism to prevent main hot buckets from being polluted with fringe events.\n"},"quarantinePastSecs":{"type":"integer","description":"Events with timestamp of quarantinePastSecs older than \"now\" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.\n"},"rawChunkSizeBytes":{"type":"integer","description":"Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.\n"},"repFactor":{"type":"string","description":"Index replication control. This parameter applies to only clustering slaves.\nauto = Use the master index replication configuration value.\n0 = Turn off replication for this index.\n"},"rotatePeriodInSecs":{"type":"integer","description":"How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.\n"},"serviceMetaPeriod":{"type":"integer","description":"Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).\nYou may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.\n"},"syncMeta":{"type":"boolean","description":"When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.\n"},"thawedPath":{"type":"string","description":"An absolute path that contains the thawed (resurrected) databases for the index.\nCannot be defined in terms of a volume definition.\nRequired. Splunk software does not start if an index lacks a valid thawedPath.\n"},"throttleCheckPeriod":{"type":"integer","description":"Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).\n"},"tstatsHomePath":{"type":"string","description":"Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.\nIf specified, it must be defined in terms of a volume definition.\n"},"warmToColdScript":{"type":"string","description":"Path to a script to run when moving data from warm to cold.\nThis attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.\n"}},"stateInputs":{"description":"Input properties used for looking up and filtering Indexes resources.\n","properties":{"acl":{"$ref":"#/types/splunk:index/IndexesAcl:IndexesAcl","description":"The app/user context that is the namespace for the resource\n"},"blockSignSize":{"type":"integer","description":"Controls how many events make up a block for block signatures. If this is set to 0, block signing is disabled for this index. \u003cbr\u003eA recommended value is 100.\n"},"bucketRebuildMemoryHint":{"type":"string","description":"Suggestion for the bucket rebuild process for the size of the time-series (tsidx) file to make.\n\u003cbe\u003eCaution: This is an advanced parameter. Inappropriate use of this parameter causes splunkd to not start if rebuild is required. Do not set this parameter unless instructed by Splunk Support.\nDefault value, auto, varies by the amount of physical RAM on the host\u003cbr\u003e\nless than 2GB RAM = 67108864 (64MB) tsidx\n2GB to 8GB RAM = 134217728 (128MB) tsidx\nmore than 8GB RAM = 268435456 (256MB) tsidx\u003cbr\u003e\nValues other than \"auto\" must be 16MB-1GB. Highest legal value (of the numerical part) is 4294967295 You can specify the value using a size suffix: \"16777216\" or \"16MB\" are equivalent.\n"},"coldPath":{"type":"string","description":"An absolute path that contains the colddbs for the index. The path must be readable and writable. Cold databases are opened as needed when searching.\n"},"coldToFrozenDir":{"type":"string","description":"Destination path for the frozen archive. Use as an alternative to a coldToFrozenScript. Splunk software automatically puts frozen buckets in this directory.\n\u003cbr\u003e\nBucket freezing policy is as follows:\u003cbr\u003e\nNew style buckets (4.2 and on): removes all files but the rawdata\u003cbr\u003e\nTo thaw, run splunk rebuild \u003cbucket dir\u003e on the bucket, then move to the thawed directory\u003cbr\u003e\nOld style buckets (Pre-4.2): gzip all the .data and .tsidx files\u003cbr\u003e\nTo thaw, gunzip the zipped files and move the bucket into the thawed directory\u003cbr\u003e\nIf both coldToFrozenDir and coldToFrozenScript are specified, coldToFrozenDir takes precedence\n"},"coldToFrozenScript":{"type":"string","description":"Path to the archiving script.\n\u003cbr\u003eIf your script requires a program to run it (for example, python), specify the program followed by the path. The script must be in $SPLUNK_HOME/bin or one of its subdirectories.\n\u003cbr\u003eSplunk software ships with an example archiving script in $SPLUNK_HOME/bin called coldToFrozenExample.py. DO NOT use this example script directly. It uses a default path, and if modified in place any changes are overwritten on upgrade.\n\u003cbr\u003eIt is best to copy the example script to a new file in bin and modify it for your system. Most importantly, change the default archive path to an existing directory that fits your needs.\n"},"compressRawdata":{"type":"boolean","description":"This parameter is ignored. The splunkd process always compresses raw data.\n"},"datatype":{"type":"string","description":"Valid values: (event | metric). Specifies the type of index.\n"},"enableOnlineBucketRepair":{"type":"boolean","description":"Enables asynchronous \"online fsck\" bucket repair, which runs concurrently with Splunk software.\nWhen enabled, you do not have to wait until buckets are repaired to start the Splunk platform. However, you might observe a slight performance degratation.\n"},"frozenTimePeriodInSecs":{"type":"integer","description":"Number of seconds after which indexed data rolls to frozen.\nDefaults to 188697600 (6 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.\n"},"homePath":{"type":"string","description":"An absolute path that contains the hot and warm buckets for the index.\nRequired. Splunk software does not start if an index lacks a valid homePath.\n\u003cbr\u003eCaution: The path must be readable and writable.\n"},"maxBloomBackfillBucketAge":{"type":"string","description":"Valid values are: Integer[m|s|h|d].\n\u003cbr\u003eIf a warm or cold bucket is older than the specified age, do not create or rebuild its bloomfilter. Specify 0 to never rebuild bloomfilters.\n"},"maxConcurrentOptimizes":{"type":"integer","description":"The number of concurrent optimize processes that can run against a hot bucket.\nThis number should be increased if instructed by Splunk Support. Typically the default value should suffice.\n"},"maxDataSize":{"type":"string","description":"The maximum size in MB for a hot DB to reach before a roll to warm is triggered. Specifying \"auto\" or \u003cspan pulumi-lang-nodejs=\"\"autoHighVolume\"\" pulumi-lang-dotnet=\"\"AutoHighVolume\"\" pulumi-lang-go=\"\"autoHighVolume\"\" pulumi-lang-python=\"\"auto_high_volume\"\" pulumi-lang-yaml=\"\"autoHighVolume\"\" pulumi-lang-java=\"\"autoHighVolume\"\"\u003e\"auto_high_volume\"\u003c/span\u003e causes Splunk software to autotune this parameter (recommended).\nUse \u003cspan pulumi-lang-nodejs=\"\"autoHighVolume\"\" pulumi-lang-dotnet=\"\"AutoHighVolume\"\" pulumi-lang-go=\"\"autoHighVolume\"\" pulumi-lang-python=\"\"auto_high_volume\"\" pulumi-lang-yaml=\"\"autoHighVolume\"\" pulumi-lang-java=\"\"autoHighVolume\"\"\u003e\"auto_high_volume\"\u003c/span\u003e for high volume indexes (such as the main index); otherwise, use \"auto\". A \"high volume index\" would typically be considered one that gets over 10GB of data per day.\n"},"maxHotBuckets":{"type":"integer","description":"Maximum hot buckets that can exist per index. Defaults to 3.\n\u003cbr\u003eWhen maxHotBuckets is exceeded, Splunk software rolls the least recently used (LRU) hot bucket to warm. Both normal hot buckets and quarantined hot buckets count towards this total. This setting operates independently of maxHotIdleSecs, which can also cause hot buckets to roll.\n"},"maxHotIdleSecs":{"type":"integer","description":"Maximum life, in seconds, of a hot bucket. Defaults to 0. If a hot bucket exceeds maxHotIdleSecs, Splunk software rolls it to warm. This setting operates independently of maxHotBuckets, which can also cause hot buckets to roll. A value of 0 turns off the idle check (equivalent to INFINITE idle time).\n"},"maxHotSpanSecs":{"type":"integer","description":"Upper bound of target maximum timespan of hot/warm buckets in seconds. Defaults to 7776000 seconds (90 days).\n"},"maxMemMb":{"type":"integer","description":"The amount of memory, expressed in MB, to allocate for buffering a single tsidx file into memory before flushing to disk. Defaults to 5. The default is recommended for all environments.\n"},"maxMetaEntries":{"type":"integer","description":"Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored. If there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies. Highest legal value is 2147483647. To disable this parameter, set to 0.\n"},"maxTimeUnreplicatedNoAcks":{"type":"integer","description":"Upper limit, in seconds, on how long an event can sit in raw slice. Applies only if replication is enabled for this index. Otherwise ignored.\nIf there are any acknowledged events sharing this raw slice, this paramater does not apply. In this case, maxTimeUnreplicatedWithAcks applies.\nHighest legal value is 2147483647. To disable this parameter, set to 0.\n"},"maxTimeUnreplicatedWithAcks":{"type":"integer","description":"Upper limit, in seconds, on how long events can sit unacknowledged in a raw slice. Applies only if you have enabled acks on forwarders and have replication enabled (with clustering).\nNote: This is an advanced parameter. Make sure you understand the settings on all forwarders before changing this. This number should not exceed ack timeout configured on any forwarder, and should actually be set to at most half of the minimum value of that timeout. You can find this setting in outputs.conf readTimeout setting under the tcpout stanza.\nTo disable, set to 0, but this is NOT recommended. Highest legal value is 2147483647.\n"},"maxTotalDataSizeMb":{"type":"integer","description":"The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.\n"},"maxWarmDbCount":{"type":"integer","description":"The maximum number of warm buckets. If this number is exceeded, the warm bucket/s with the lowest value for their latest times is moved to cold.\n"},"minRawFileSyncSecs":{"type":"string","description":"Specify an integer (or \"disable\") for this parameter.\nThis parameter sets how frequently splunkd forces a filesystem sync while compressing journal slices.\nDuring this period, uncompressed slices are left on disk even after they are compressed. Then splunkd forces a filesystem sync of the compressed journal and removes the accumulated uncompressed files.\nIf 0 is specified, splunkd forces a filesystem sync after every slice completes compressing. Specifying \"disable\" disables syncing entirely: uncompressed slices are removed as soon as compression is complete.\n"},"minStreamGroupQueueSize":{"type":"integer","description":"Minimum size of the queue that stores events in memory before committing them to a tsidx file.\n"},"name":{"type":"string","description":"The name of the index to create.\n","willReplaceOnChanges":true},"partialServiceMetaPeriod":{"type":"integer","description":"Related to serviceMetaPeriod. If set, it enables metadata sync every \u003cinteger\u003e seconds, but only for records where the sync can be done efficiently in-place, without requiring a full re-write of the metadata file. Records that require full re-write are be sync'ed at serviceMetaPeriod.\npartialServiceMetaPeriod specifies, in seconds, how frequently it should sync. Zero means that this feature is turned off and serviceMetaPeriod is the only time when metadata sync happens.\nIf the value of partialServiceMetaPeriod is greater than serviceMetaPeriod, this setting has no effect.\nBy default it is turned off (zero).\n"},"processTrackerServiceInterval":{"type":"integer","description":"Specifies, in seconds, how often the indexer checks the status of the child OS processes it launched to see if it can launch new processes for queued requests. Defaults to 15.\nIf set to 0, the indexer checks child process status every second.\nHighest legal value is 4294967295.\n"},"quarantineFutureSecs":{"type":"integer","description":"Events with timestamp of quarantineFutureSecs newer than \"now\" are dropped into quarantine bucket. Defaults to 2592000 (30 days).\nThis is a mechanism to prevent main hot buckets from being polluted with fringe events.\n"},"quarantinePastSecs":{"type":"integer","description":"Events with timestamp of quarantinePastSecs older than \"now\" are dropped into quarantine bucket. Defaults to 77760000 (900 days). This is a mechanism to prevent the main hot buckets from being polluted with fringe events.\n"},"rawChunkSizeBytes":{"type":"integer","description":"Target uncompressed size in bytes for individual raw slice in the rawdata journal of the index. Defaults to 131072 (128KB). 0 is not a valid value. If 0 is specified, rawChunkSizeBytes is set to the default value.\n"},"repFactor":{"type":"string","description":"Index replication control. This parameter applies to only clustering slaves.\nauto = Use the master index replication configuration value.\n0 = Turn off replication for this index.\n"},"rotatePeriodInSecs":{"type":"integer","description":"How frequently (in seconds) to check if a new hot bucket needs to be created. Also, how frequently to check if there are any warm/cold buckets that should be rolled/frozen.\n"},"serviceMetaPeriod":{"type":"integer","description":"Defines how frequently metadata is synced to disk, in seconds. Defaults to 25 (seconds).\nYou may want to set this to a higher value if the sum of your metadata file sizes is larger than many tens of megabytes, to avoid the hit on I/O in the indexing fast path.\n"},"syncMeta":{"type":"boolean","description":"When true, a sync operation is called before file descriptor is closed on metadata file updates. This functionality improves integrity of metadata files, especially in regards to operating system crashes/machine failures.\n"},"thawedPath":{"type":"string","description":"An absolute path that contains the thawed (resurrected) databases for the index.\nCannot be defined in terms of a volume definition.\nRequired. Splunk software does not start if an index lacks a valid thawedPath.\n"},"throttleCheckPeriod":{"type":"integer","description":"Defines how frequently Splunk software checks for index throttling condition, in seconds. Defaults to 15 (seconds).\n"},"tstatsHomePath":{"type":"string","description":"Location to store datamodel acceleration TSIDX data for this index. Restart splunkd after changing this parameter.\nIf specified, it must be defined in terms of a volume definition.\n"},"warmToColdScript":{"type":"string","description":"Path to a script to run when moving data from warm to cold.\nThis attribute is supported for backwards compatibility with Splunk software versions older than 4.0. Contact Splunk support if you need help configuring this setting.\n"}},"type":"object"}},"splunk:index/inputsHttpEventCollector:InputsHttpEventCollector":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.InputsHttpEventCollector\n\" pulumi-lang-dotnet=\" splunk.InputsHttpEventCollector\n\" pulumi-lang-go=\" InputsHttpEventCollector\n\" pulumi-lang-python=\" InputsHttpEventCollector\n\" pulumi-lang-yaml=\" splunk.InputsHttpEventCollector\n\" pulumi-lang-java=\" splunk.InputsHttpEventCollector\n\"\u003e splunk.InputsHttpEventCollector\n\u003c/span\u003e\nCreate or update HTTP Event Collector input configuration tokens.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst hec_token_01 = new splunk.InputsHttpEventCollector(\"hec-token-01\", {\n    name: \"hec-token-01\",\n    index: \"main\",\n    indexes: [\n        \"main\",\n        \"history\",\n        \"summary\",\n    ],\n    source: \"new:source\",\n    sourcetype: \"new:sourcetype\",\n    disabled: false,\n    useAck: 0,\n    acl: {\n        owner: \"user01\",\n        sharing: \"global\",\n        reads: [\"admin\"],\n        writes: [\"admin\"],\n    },\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\nhec_token_01 = splunk.InputsHttpEventCollector(\"hec-token-01\",\n    name=\"hec-token-01\",\n    index=\"main\",\n    indexes=[\n        \"main\",\n        \"history\",\n        \"summary\",\n    ],\n    source=\"new:source\",\n    sourcetype=\"new:sourcetype\",\n    disabled=False,\n    use_ack=0,\n    acl={\n        \"owner\": \"user01\",\n        \"sharing\": \"global\",\n        \"reads\": [\"admin\"],\n        \"writes\": [\"admin\"],\n    })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var hec_token_01 = new Splunk.InputsHttpEventCollector(\"hec-token-01\", new()\n    {\n        Name = \"hec-token-01\",\n        Index = \"main\",\n        Indexes = new[]\n        {\n            \"main\",\n            \"history\",\n            \"summary\",\n        },\n        Source = \"new:source\",\n        Sourcetype = \"new:sourcetype\",\n        Disabled = false,\n        UseAck = 0,\n        Acl = new Splunk.Inputs.InputsHttpEventCollectorAclArgs\n        {\n            Owner = \"user01\",\n            Sharing = \"global\",\n            Reads = new[]\n            {\n                \"admin\",\n            },\n            Writes = new[]\n            {\n                \"admin\",\n            },\n        },\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewInputsHttpEventCollector(ctx, \"hec-token-01\", \u0026splunk.InputsHttpEventCollectorArgs{\n\t\t\tName:  pulumi.String(\"hec-token-01\"),\n\t\t\tIndex: pulumi.String(\"main\"),\n\t\t\tIndexes: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"main\"),\n\t\t\t\tpulumi.String(\"history\"),\n\t\t\t\tpulumi.String(\"summary\"),\n\t\t\t},\n\t\t\tSource:     pulumi.String(\"new:source\"),\n\t\t\tSourcetype: pulumi.String(\"new:sourcetype\"),\n\t\t\tDisabled:   pulumi.Bool(false),\n\t\t\tUseAck:     pulumi.Int(0),\n\t\t\tAcl: \u0026splunk.InputsHttpEventCollectorAclArgs{\n\t\t\t\tOwner:   pulumi.String(\"user01\"),\n\t\t\t\tSharing: pulumi.String(\"global\"),\n\t\t\t\tReads: pulumi.StringArray{\n\t\t\t\t\tpulumi.String(\"admin\"),\n\t\t\t\t},\n\t\t\t\tWrites: pulumi.StringArray{\n\t\t\t\t\tpulumi.String(\"admin\"),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.InputsHttpEventCollector;\nimport com.pulumi.splunk.InputsHttpEventCollectorArgs;\nimport com.pulumi.splunk.inputs.InputsHttpEventCollectorAclArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var hec_token_01 = new InputsHttpEventCollector(\"hec-token-01\", InputsHttpEventCollectorArgs.builder()\n            .name(\"hec-token-01\")\n            .index(\"main\")\n            .indexes(            \n                \"main\",\n                \"history\",\n                \"summary\")\n            .source(\"new:source\")\n            .sourcetype(\"new:sourcetype\")\n            .disabled(false)\n            .useAck(0)\n            .acl(InputsHttpEventCollectorAclArgs.builder()\n                .owner(\"user01\")\n                .sharing(\"global\")\n                .reads(\"admin\")\n                .writes(\"admin\")\n                .build())\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  hec-token-01:\n    type: splunk:InputsHttpEventCollector\n    properties:\n      name: hec-token-01\n      index: main\n      indexes:\n        - main\n        - history\n        - summary\n      source: new:source\n      sourcetype: new:sourcetype\n      disabled: false\n      useAck: 0\n      acl:\n        owner: user01\n        sharing: global\n        reads:\n          - admin\n        writes:\n          - admin\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n```\nterraform import splunk_inputs_http_event_collector.token01 \u003chec-token-name\u003e\n```\n","properties":{"acl":{"$ref":"#/types/splunk:index/InputsHttpEventCollectorAcl:InputsHttpEventCollectorAcl","description":"The app/user context that is the namespace for the resource\n"},"disabled":{"type":"boolean","description":"Input disabled indicator\n"},"host":{"type":"string","description":"Default host value for events with this token\n"},"index":{"type":"string","description":"Index to store generated events\n"},"indexes":{"type":"array","items":{"type":"string"},"description":"Set of indexes allowed for events with this token\n"},"name":{"type":"string","description":"Token name (inputs.conf key)\n"},"source":{"type":"string","description":"Default source for events with this token\n"},"sourcetype":{"type":"string","description":"Default source type for events with this token\n"},"token":{"type":"string","description":"Token value for sending data to collector/event endpoint\n"},"useAck":{"type":"integer","description":"Indexer acknowledgement for this token\n"}},"required":["acl","disabled","host","index","indexes","name","source","sourcetype","token","useAck"],"inputProperties":{"acl":{"$ref":"#/types/splunk:index/InputsHttpEventCollectorAcl:InputsHttpEventCollectorAcl","description":"The app/user context that is the namespace for the resource\n"},"disabled":{"type":"boolean","description":"Input disabled indicator\n"},"host":{"type":"string","description":"Default host value for events with this token\n"},"index":{"type":"string","description":"Index to store generated events\n"},"indexes":{"type":"array","items":{"type":"string"},"description":"Set of indexes allowed for events with this token\n"},"name":{"type":"string","description":"Token name (inputs.conf key)\n","willReplaceOnChanges":true},"source":{"type":"string","description":"Default source for events with this token\n"},"sourcetype":{"type":"string","description":"Default source type for events with this token\n"},"token":{"type":"string","description":"Token value for sending data to collector/event endpoint\n"},"useAck":{"type":"integer","description":"Indexer acknowledgement for this token\n"}},"stateInputs":{"description":"Input properties used for looking up and filtering InputsHttpEventCollector resources.\n","properties":{"acl":{"$ref":"#/types/splunk:index/InputsHttpEventCollectorAcl:InputsHttpEventCollectorAcl","description":"The app/user context that is the namespace for the resource\n"},"disabled":{"type":"boolean","description":"Input disabled indicator\n"},"host":{"type":"string","description":"Default host value for events with this token\n"},"index":{"type":"string","description":"Index to store generated events\n"},"indexes":{"type":"array","items":{"type":"string"},"description":"Set of indexes allowed for events with this token\n"},"name":{"type":"string","description":"Token name (inputs.conf key)\n","willReplaceOnChanges":true},"source":{"type":"string","description":"Default source for events with this token\n"},"sourcetype":{"type":"string","description":"Default source type for events with this token\n"},"token":{"type":"string","description":"Token value for sending data to collector/event endpoint\n"},"useAck":{"type":"integer","description":"Indexer acknowledgement for this token\n"}},"type":"object"}},"splunk:index/inputsMonitor:InputsMonitor":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.InputsMonitor\n\" pulumi-lang-dotnet=\" splunk.InputsMonitor\n\" pulumi-lang-go=\" InputsMonitor\n\" pulumi-lang-python=\" InputsMonitor\n\" pulumi-lang-yaml=\" splunk.InputsMonitor\n\" pulumi-lang-java=\" splunk.InputsMonitor\n\"\u003e splunk.InputsMonitor\n\u003c/span\u003e\nCreate or update a new file or directory monitor input.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst monitor = new splunk.InputsMonitor(\"monitor\", {\n    name: \"opt/splunk/var/log/splunk/health.log\",\n    recursive: true,\n    sourcetype: \"text\",\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\nmonitor = splunk.InputsMonitor(\"monitor\",\n    name=\"opt/splunk/var/log/splunk/health.log\",\n    recursive=True,\n    sourcetype=\"text\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var monitor = new Splunk.InputsMonitor(\"monitor\", new()\n    {\n        Name = \"opt/splunk/var/log/splunk/health.log\",\n        Recursive = true,\n        Sourcetype = \"text\",\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewInputsMonitor(ctx, \"monitor\", \u0026splunk.InputsMonitorArgs{\n\t\t\tName:       pulumi.String(\"opt/splunk/var/log/splunk/health.log\"),\n\t\t\tRecursive:  pulumi.Bool(true),\n\t\t\tSourcetype: pulumi.String(\"text\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.InputsMonitor;\nimport com.pulumi.splunk.InputsMonitorArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var monitor = new InputsMonitor(\"monitor\", InputsMonitorArgs.builder()\n            .name(\"opt/splunk/var/log/splunk/health.log\")\n            .recursive(true)\n            .sourcetype(\"text\")\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  monitor:\n    type: splunk:InputsMonitor\n    properties:\n      name: opt/splunk/var/log/splunk/health.log\n      recursive: true\n      sourcetype: text\n```\n\u003c!--End PulumiCodeChooser --\u003e\n","properties":{"acl":{"$ref":"#/types/splunk:index/InputsMonitorAcl:InputsMonitorAcl","description":"The app/user context that is the namespace for the resource\n"},"blacklist":{"type":"string","description":"Specify a regular expression for a file path. The file path that matches this regular expression is not indexed.\n"},"crcSalt":{"type":"string","description":"A string that modifies the file tracking identity for files in this input. The magic value \u003cSOURCE\u003e invokes special behavior.\n"},"disabled":{"type":"boolean","description":"Indicates if input monitoring is disabled.\n"},"followTail":{"type":"boolean","description":"If set to true, files that are seen for the first time is read from the end.\n"},"host":{"type":"string","description":"The value to populate in the host field for events from this data input.\n"},"hostRegex":{"type":"string","description":"Specify a regular expression for a file path. If the path for a file matches this regular expression, the captured value is used to populate the host field for events from this data input. The regular expression must have one capture group.\n"},"hostSegment":{"type":"integer","description":"Use the specified slash-separate segment of the filepath as the host field value.\n"},"ignoreOlderThan":{"type":"string","description":"Specify a time value. If the modification time of a file being monitored falls outside of this rolling time window, the file is no longer being monitored.\n"},"index":{"type":"string","description":"Which index events from this input should be stored in. Defaults to default.\n"},"name":{"type":"string","description":"The file or directory path to monitor on the system.\n"},"recursive":{"type":"boolean","description":"Setting this to false prevents monitoring of any subdirectories encountered within this data input.\n"},"renameSource":{"type":"string","description":"The value to populate in the source field for events from this data input. The same source should not be used for multiple data inputs.\n"},"sourcetype":{"type":"string","description":"The value to populate in the sourcetype field for incoming events.\n"},"timeBeforeClose":{"type":"integer","description":"When Splunk software reaches the end of a file that is being read, the file is kept open for a minimum of the number of seconds specified in this value. After this period has elapsed, the file is checked again for more data.\n"},"whitelist":{"type":"string","description":"Specify a regular expression for a file path. Only file paths that match this regular expression are indexed.\n"}},"required":["acl","blacklist","crcSalt","disabled","followTail","host","hostRegex","hostSegment","ignoreOlderThan","index","name","recursive","renameSource","sourcetype","timeBeforeClose","whitelist"],"inputProperties":{"acl":{"$ref":"#/types/splunk:index/InputsMonitorAcl:InputsMonitorAcl","description":"The app/user context that is the namespace for the resource\n"},"blacklist":{"type":"string","description":"Specify a regular expression for a file path. The file path that matches this regular expression is not indexed.\n"},"crcSalt":{"type":"string","description":"A string that modifies the file tracking identity for files in this input. The magic value \u003cSOURCE\u003e invokes special behavior.\n"},"disabled":{"type":"boolean","description":"Indicates if input monitoring is disabled.\n"},"followTail":{"type":"boolean","description":"If set to true, files that are seen for the first time is read from the end.\n"},"host":{"type":"string","description":"The value to populate in the host field for events from this data input.\n"},"hostRegex":{"type":"string","description":"Specify a regular expression for a file path. If the path for a file matches this regular expression, the captured value is used to populate the host field for events from this data input. The regular expression must have one capture group.\n"},"hostSegment":{"type":"integer","description":"Use the specified slash-separate segment of the filepath as the host field value.\n"},"ignoreOlderThan":{"type":"string","description":"Specify a time value. If the modification time of a file being monitored falls outside of this rolling time window, the file is no longer being monitored.\n"},"index":{"type":"string","description":"Which index events from this input should be stored in. Defaults to default.\n"},"name":{"type":"string","description":"The file or directory path to monitor on the system.\n","willReplaceOnChanges":true},"recursive":{"type":"boolean","description":"Setting this to false prevents monitoring of any subdirectories encountered within this data input.\n"},"renameSource":{"type":"string","description":"The value to populate in the source field for events from this data input. The same source should not be used for multiple data inputs.\n"},"sourcetype":{"type":"string","description":"The value to populate in the sourcetype field for incoming events.\n"},"timeBeforeClose":{"type":"integer","description":"When Splunk software reaches the end of a file that is being read, the file is kept open for a minimum of the number of seconds specified in this value. After this period has elapsed, the file is checked again for more data.\n"},"whitelist":{"type":"string","description":"Specify a regular expression for a file path. Only file paths that match this regular expression are indexed.\n"}},"stateInputs":{"description":"Input properties used for looking up and filtering InputsMonitor resources.\n","properties":{"acl":{"$ref":"#/types/splunk:index/InputsMonitorAcl:InputsMonitorAcl","description":"The app/user context that is the namespace for the resource\n"},"blacklist":{"type":"string","description":"Specify a regular expression for a file path. The file path that matches this regular expression is not indexed.\n"},"crcSalt":{"type":"string","description":"A string that modifies the file tracking identity for files in this input. The magic value \u003cSOURCE\u003e invokes special behavior.\n"},"disabled":{"type":"boolean","description":"Indicates if input monitoring is disabled.\n"},"followTail":{"type":"boolean","description":"If set to true, files that are seen for the first time is read from the end.\n"},"host":{"type":"string","description":"The value to populate in the host field for events from this data input.\n"},"hostRegex":{"type":"string","description":"Specify a regular expression for a file path. If the path for a file matches this regular expression, the captured value is used to populate the host field for events from this data input. The regular expression must have one capture group.\n"},"hostSegment":{"type":"integer","description":"Use the specified slash-separate segment of the filepath as the host field value.\n"},"ignoreOlderThan":{"type":"string","description":"Specify a time value. If the modification time of a file being monitored falls outside of this rolling time window, the file is no longer being monitored.\n"},"index":{"type":"string","description":"Which index events from this input should be stored in. Defaults to default.\n"},"name":{"type":"string","description":"The file or directory path to monitor on the system.\n","willReplaceOnChanges":true},"recursive":{"type":"boolean","description":"Setting this to false prevents monitoring of any subdirectories encountered within this data input.\n"},"renameSource":{"type":"string","description":"The value to populate in the source field for events from this data input. The same source should not be used for multiple data inputs.\n"},"sourcetype":{"type":"string","description":"The value to populate in the sourcetype field for incoming events.\n"},"timeBeforeClose":{"type":"integer","description":"When Splunk software reaches the end of a file that is being read, the file is kept open for a minimum of the number of seconds specified in this value. After this period has elapsed, the file is checked again for more data.\n"},"whitelist":{"type":"string","description":"Specify a regular expression for a file path. Only file paths that match this regular expression are indexed.\n"}},"type":"object"}},"splunk:index/inputsScript:InputsScript":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.InputsScript\n\" pulumi-lang-dotnet=\" splunk.InputsScript\n\" pulumi-lang-go=\" InputsScript\n\" pulumi-lang-python=\" InputsScript\n\" pulumi-lang-yaml=\" splunk.InputsScript\n\" pulumi-lang-java=\" splunk.InputsScript\n\"\u003e splunk.InputsScript\n\u003c/span\u003e\nCreate or update scripted inputs.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst script = new splunk.InputsScript(\"script\", {\n    name: \"opt/splunk/bin/scripts/readme.txt\",\n    interval: 360,\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\nscript = splunk.InputsScript(\"script\",\n    name=\"opt/splunk/bin/scripts/readme.txt\",\n    interval=360)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var script = new Splunk.InputsScript(\"script\", new()\n    {\n        Name = \"opt/splunk/bin/scripts/readme.txt\",\n        Interval = 360,\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewInputsScript(ctx, \"script\", \u0026splunk.InputsScriptArgs{\n\t\t\tName:     pulumi.String(\"opt/splunk/bin/scripts/readme.txt\"),\n\t\t\tInterval: pulumi.Int(360),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.InputsScript;\nimport com.pulumi.splunk.InputsScriptArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var script = new InputsScript(\"script\", InputsScriptArgs.builder()\n            .name(\"opt/splunk/bin/scripts/readme.txt\")\n            .interval(360)\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  script:\n    type: splunk:InputsScript\n    properties:\n      name: opt/splunk/bin/scripts/readme.txt\n      interval: 360\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n```\nterraform import splunk_inputs_script.bar \"\\$SPLUNK_HOME/etc/apps/splunk_instrumentation/bin/instrumentation.py\"\n```\n","properties":{"acl":{"$ref":"#/types/splunk:index/InputsScriptAcl:InputsScriptAcl","description":"The app/user context that is the namespace for the resource\n"},"disabled":{"type":"boolean","description":"Specifies whether the input script is disabled.\n"},"host":{"type":"string","description":"Sets the host for events from this input. Defaults to whatever host sent the event.\n"},"index":{"type":"string","description":"Sets the index for events from this input. Defaults to the main index.\n"},"interval":{"type":"integer","description":"Specify an integer or cron schedule. This parameter specifies how often to execute the specified script, in seconds or a valid cron schedule. If you specify a cron schedule, the script is not executed on start-up.\n"},"name":{"type":"string","description":"Specify the name of the scripted input.\n"},"passauth":{"type":"string","description":"User to run the script as. If you provide a username, Splunk software generates an auth token for that user and passes it to the script.\n"},"renameSource":{"type":"string","description":"Specify a new name for the source field for the script.\n"},"source":{"type":"string","description":"Sets the source key/field for events from this input. Defaults to the input file path.\nSets the source key initial value. The key is used during parsing/indexing, in particular to set the source field during indexing. It is also the source field used at search time. As a convenience, the chosen string is prepended with 'source::'.\n"},"sourcetype":{"type":"string","description":"Sets the sourcetype key/field for events from this input. If unset, Splunk software picks a source type based on various aspects of the data. As a convenience, the chosen string is prepended with 'sourcetype::'. There is no hard-coded default.\nSets the sourcetype key initial value. The key is used during parsing/indexing, in particular to set the source type field during indexing. It is also the source type field used at search time.\n"}},"required":["acl","disabled","host","index","interval","name","passauth","renameSource","source","sourcetype"],"inputProperties":{"acl":{"$ref":"#/types/splunk:index/InputsScriptAcl:InputsScriptAcl","description":"The app/user context that is the namespace for the resource\n"},"disabled":{"type":"boolean","description":"Specifies whether the input script is disabled.\n"},"host":{"type":"string","description":"Sets the host for events from this input. Defaults to whatever host sent the event.\n"},"index":{"type":"string","description":"Sets the index for events from this input. Defaults to the main index.\n"},"interval":{"type":"integer","description":"Specify an integer or cron schedule. This parameter specifies how often to execute the specified script, in seconds or a valid cron schedule. If you specify a cron schedule, the script is not executed on start-up.\n"},"name":{"type":"string","description":"Specify the name of the scripted input.\n","willReplaceOnChanges":true},"passauth":{"type":"string","description":"User to run the script as. If you provide a username, Splunk software generates an auth token for that user and passes it to the script.\n"},"renameSource":{"type":"string","description":"Specify a new name for the source field for the script.\n"},"source":{"type":"string","description":"Sets the source key/field for events from this input. Defaults to the input file path.\nSets the source key initial value. The key is used during parsing/indexing, in particular to set the source field during indexing. It is also the source field used at search time. As a convenience, the chosen string is prepended with 'source::'.\n"},"sourcetype":{"type":"string","description":"Sets the sourcetype key/field for events from this input. If unset, Splunk software picks a source type based on various aspects of the data. As a convenience, the chosen string is prepended with 'sourcetype::'. There is no hard-coded default.\nSets the sourcetype key initial value. The key is used during parsing/indexing, in particular to set the source type field during indexing. It is also the source type field used at search time.\n"}},"requiredInputs":["interval"],"stateInputs":{"description":"Input properties used for looking up and filtering InputsScript resources.\n","properties":{"acl":{"$ref":"#/types/splunk:index/InputsScriptAcl:InputsScriptAcl","description":"The app/user context that is the namespace for the resource\n"},"disabled":{"type":"boolean","description":"Specifies whether the input script is disabled.\n"},"host":{"type":"string","description":"Sets the host for events from this input. Defaults to whatever host sent the event.\n"},"index":{"type":"string","description":"Sets the index for events from this input. Defaults to the main index.\n"},"interval":{"type":"integer","description":"Specify an integer or cron schedule. This parameter specifies how often to execute the specified script, in seconds or a valid cron schedule. If you specify a cron schedule, the script is not executed on start-up.\n"},"name":{"type":"string","description":"Specify the name of the scripted input.\n","willReplaceOnChanges":true},"passauth":{"type":"string","description":"User to run the script as. If you provide a username, Splunk software generates an auth token for that user and passes it to the script.\n"},"renameSource":{"type":"string","description":"Specify a new name for the source field for the script.\n"},"source":{"type":"string","description":"Sets the source key/field for events from this input. Defaults to the input file path.\nSets the source key initial value. The key is used during parsing/indexing, in particular to set the source field during indexing. It is also the source field used at search time. As a convenience, the chosen string is prepended with 'source::'.\n"},"sourcetype":{"type":"string","description":"Sets the sourcetype key/field for events from this input. If unset, Splunk software picks a source type based on various aspects of the data. As a convenience, the chosen string is prepended with 'sourcetype::'. There is no hard-coded default.\nSets the sourcetype key initial value. The key is used during parsing/indexing, in particular to set the source type field during indexing. It is also the source type field used at search time.\n"}},"type":"object"}},"splunk:index/inputsTcpCooked:InputsTcpCooked":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.InputsTcpCooked\n\" pulumi-lang-dotnet=\" splunk.InputsTcpCooked\n\" pulumi-lang-go=\" InputsTcpCooked\n\" pulumi-lang-python=\" InputsTcpCooked\n\" pulumi-lang-yaml=\" splunk.InputsTcpCooked\n\" pulumi-lang-java=\" splunk.InputsTcpCooked\n\"\u003e splunk.InputsTcpCooked\n\u003c/span\u003e\nCreate or update cooked TCP input information and create new containers for managing cooked data.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst tcpCooked = new splunk.InputsTcpCooked(\"tcp_cooked\", {\n    name: \"50000\",\n    disabled: false,\n    connectionHost: \"dns\",\n    restrictToHost: \"splunk\",\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\ntcp_cooked = splunk.InputsTcpCooked(\"tcp_cooked\",\n    name=\"50000\",\n    disabled=False,\n    connection_host=\"dns\",\n    restrict_to_host=\"splunk\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var tcpCooked = new Splunk.InputsTcpCooked(\"tcp_cooked\", new()\n    {\n        Name = \"50000\",\n        Disabled = false,\n        ConnectionHost = \"dns\",\n        RestrictToHost = \"splunk\",\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewInputsTcpCooked(ctx, \"tcp_cooked\", \u0026splunk.InputsTcpCookedArgs{\n\t\t\tName:           pulumi.String(\"50000\"),\n\t\t\tDisabled:       pulumi.Bool(false),\n\t\t\tConnectionHost: pulumi.String(\"dns\"),\n\t\t\tRestrictToHost: pulumi.String(\"splunk\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.InputsTcpCooked;\nimport com.pulumi.splunk.InputsTcpCookedArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var tcpCooked = new InputsTcpCooked(\"tcpCooked\", InputsTcpCookedArgs.builder()\n            .name(\"50000\")\n            .disabled(false)\n            .connectionHost(\"dns\")\n            .restrictToHost(\"splunk\")\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  tcpCooked:\n    type: splunk:InputsTcpCooked\n    name: tcp_cooked\n    properties:\n      name: '50000'\n      disabled: false\n      connectionHost: dns\n      restrictToHost: splunk\n```\n\u003c!--End PulumiCodeChooser --\u003e\n","properties":{"acl":{"$ref":"#/types/splunk:index/InputsTcpCookedAcl:InputsTcpCookedAcl","description":"The app/user context that is the namespace for the resource\n"},"connectionHost":{"type":"string","description":"Valid values: (ip | dns | none)\nSet the host for the remote server that is sending data.\nip sets the host to the IP address of the remote server sending data.\ndns sets the host to the reverse DNS entry for the IP address of the remote server sending data.\nnone leaves the host as specified in inputs.conf, which is typically the Splunk system hostname.\nDefault value is dns.\n"},"disabled":{"type":"boolean","description":"Indicates if input is disabled.\n"},"host":{"type":"string","description":"Host from which the indexer gets data.\n"},"name":{"type":"string","description":"The port number of this input.\n"},"restrictToHost":{"type":"string","description":"Restrict incoming connections on this port to the host specified here.\n"}},"required":["acl","connectionHost","disabled","host","name","restrictToHost"],"inputProperties":{"acl":{"$ref":"#/types/splunk:index/InputsTcpCookedAcl:InputsTcpCookedAcl","description":"The app/user context that is the namespace for the resource\n"},"connectionHost":{"type":"string","description":"Valid values: (ip | dns | none)\nSet the host for the remote server that is sending data.\nip sets the host to the IP address of the remote server sending data.\ndns sets the host to the reverse DNS entry for the IP address of the remote server sending data.\nnone leaves the host as specified in inputs.conf, which is typically the Splunk system hostname.\nDefault value is dns.\n"},"disabled":{"type":"boolean","description":"Indicates if input is disabled.\n"},"host":{"type":"string","description":"Host from which the indexer gets data.\n"},"name":{"type":"string","description":"The port number of this input.\n","willReplaceOnChanges":true},"restrictToHost":{"type":"string","description":"Restrict incoming connections on this port to the host specified here.\n","willReplaceOnChanges":true}},"stateInputs":{"description":"Input properties used for looking up and filtering InputsTcpCooked resources.\n","properties":{"acl":{"$ref":"#/types/splunk:index/InputsTcpCookedAcl:InputsTcpCookedAcl","description":"The app/user context that is the namespace for the resource\n"},"connectionHost":{"type":"string","description":"Valid values: (ip | dns | none)\nSet the host for the remote server that is sending data.\nip sets the host to the IP address of the remote server sending data.\ndns sets the host to the reverse DNS entry for the IP address of the remote server sending data.\nnone leaves the host as specified in inputs.conf, which is typically the Splunk system hostname.\nDefault value is dns.\n"},"disabled":{"type":"boolean","description":"Indicates if input is disabled.\n"},"host":{"type":"string","description":"Host from which the indexer gets data.\n"},"name":{"type":"string","description":"The port number of this input.\n","willReplaceOnChanges":true},"restrictToHost":{"type":"string","description":"Restrict incoming connections on this port to the host specified here.\n","willReplaceOnChanges":true}},"type":"object"}},"splunk:index/inputsTcpRaw:InputsTcpRaw":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.InputsTcpRaw\n\" pulumi-lang-dotnet=\" splunk.InputsTcpRaw\n\" pulumi-lang-go=\" InputsTcpRaw\n\" pulumi-lang-python=\" InputsTcpRaw\n\" pulumi-lang-yaml=\" splunk.InputsTcpRaw\n\" pulumi-lang-java=\" splunk.InputsTcpRaw\n\"\u003e splunk.InputsTcpRaw\n\u003c/span\u003e\nCreate or update raw TCP input information for managing raw tcp inputs from forwarders.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst tcpRaw = new splunk.InputsTcpRaw(\"tcp_raw\", {\n    name: \"41000\",\n    index: \"main\",\n    queue: \"indexQueue\",\n    source: \"new\",\n    sourcetype: \"new\",\n    disabled: false,\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\ntcp_raw = splunk.InputsTcpRaw(\"tcp_raw\",\n    name=\"41000\",\n    index=\"main\",\n    queue=\"indexQueue\",\n    source=\"new\",\n    sourcetype=\"new\",\n    disabled=False)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var tcpRaw = new Splunk.InputsTcpRaw(\"tcp_raw\", new()\n    {\n        Name = \"41000\",\n        Index = \"main\",\n        Queue = \"indexQueue\",\n        Source = \"new\",\n        Sourcetype = \"new\",\n        Disabled = false,\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewInputsTcpRaw(ctx, \"tcp_raw\", \u0026splunk.InputsTcpRawArgs{\n\t\t\tName:       pulumi.String(\"41000\"),\n\t\t\tIndex:      pulumi.String(\"main\"),\n\t\t\tQueue:      pulumi.String(\"indexQueue\"),\n\t\t\tSource:     pulumi.String(\"new\"),\n\t\t\tSourcetype: pulumi.String(\"new\"),\n\t\t\tDisabled:   pulumi.Bool(false),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.InputsTcpRaw;\nimport com.pulumi.splunk.InputsTcpRawArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var tcpRaw = new InputsTcpRaw(\"tcpRaw\", InputsTcpRawArgs.builder()\n            .name(\"41000\")\n            .index(\"main\")\n            .queue(\"indexQueue\")\n            .source(\"new\")\n            .sourcetype(\"new\")\n            .disabled(false)\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  tcpRaw:\n    type: splunk:InputsTcpRaw\n    name: tcp_raw\n    properties:\n      name: '41000'\n      index: main\n      queue: indexQueue\n      source: new\n      sourcetype: new\n      disabled: false\n```\n\u003c!--End PulumiCodeChooser --\u003e\n","properties":{"acl":{"$ref":"#/types/splunk:index/InputsTcpRawAcl:InputsTcpRawAcl","description":"The app/user context that is the namespace for the resource\n"},"connectionHost":{"type":"string","description":"Valid values: (ip | dns | none)\nSet the host for the remote server that is sending data.\nip sets the host to the IP address of the remote server sending data.\ndns sets the host to the reverse DNS entry for the IP address of the remote server sending data.\nnone leaves the host as specified in inputs.conf, which is typically the Splunk system hostname.\nDefault value is dns.\n"},"disabled":{"type":"boolean","description":"Indicates if input is disabled.\n"},"host":{"type":"string","description":"Host from which the indexer gets data.\n"},"index":{"type":"string","description":"Index to store generated events. Defaults to default.\n"},"name":{"type":"string","description":"The input port which receives raw data.\n"},"queue":{"type":"string","description":"Valid values: (parsingQueue | indexQueue)\nSpecifies where the input processor should deposit the events it reads. Defaults to parsingQueue.\nSet queue to parsingQueue to apply props.conf and other parsing rules to your data. For more information about props.conf and rules for timestamping and linebreaking, refer to props.conf and the online documentation at \"Monitor files and directories with inputs.conf\"\nSet queue to indexQueue to send your data directly into the index.\n"},"rawTcpDoneTimeout":{"type":"integer","description":"Specifies in seconds the timeout value for adding a Done-key. Default value is 10 seconds.\nIf a connection over the port specified by name remains idle after receiving data for specified number of seconds, it adds a Done-key. This implies the last event is completely received.\n"},"restrictToHost":{"type":"string","description":"Allows for restricting this input to only accept data from the host specified here.\n"},"source":{"type":"string","description":"Sets the source key/field for events from this input. Defaults to the input file path.\nSets the source key initial value. The key is used during parsing/indexing, in particular to set the source field during indexing. It is also the source field used at search time. As a convenience, the chosen string is prepended with 'source::'.\n"},"sourcetype":{"type":"string","description":"Set the source type for events from this input.\n\"sourcetype=\" is automatically prepended to \u003cstring\u003e.\nDefaults to audittrail (if signedaudit=true) or fschange (if signedaudit=false).\n"}},"required":["acl","connectionHost","disabled","host","index","name","queue","rawTcpDoneTimeout","restrictToHost","source","sourcetype"],"inputProperties":{"acl":{"$ref":"#/types/splunk:index/InputsTcpRawAcl:InputsTcpRawAcl","description":"The app/user context that is the namespace for the resource\n"},"connectionHost":{"type":"string","description":"Valid values: (ip | dns | none)\nSet the host for the remote server that is sending data.\nip sets the host to the IP address of the remote server sending data.\ndns sets the host to the reverse DNS entry for the IP address of the remote server sending data.\nnone leaves the host as specified in inputs.conf, which is typically the Splunk system hostname.\nDefault value is dns.\n"},"disabled":{"type":"boolean","description":"Indicates if input is disabled.\n"},"host":{"type":"string","description":"Host from which the indexer gets data.\n"},"index":{"type":"string","description":"Index to store generated events. Defaults to default.\n"},"name":{"type":"string","description":"The input port which receives raw data.\n","willReplaceOnChanges":true},"queue":{"type":"string","description":"Valid values: (parsingQueue | indexQueue)\nSpecifies where the input processor should deposit the events it reads. Defaults to parsingQueue.\nSet queue to parsingQueue to apply props.conf and other parsing rules to your data. For more information about props.conf and rules for timestamping and linebreaking, refer to props.conf and the online documentation at \"Monitor files and directories with inputs.conf\"\nSet queue to indexQueue to send your data directly into the index.\n"},"rawTcpDoneTimeout":{"type":"integer","description":"Specifies in seconds the timeout value for adding a Done-key. Default value is 10 seconds.\nIf a connection over the port specified by name remains idle after receiving data for specified number of seconds, it adds a Done-key. This implies the last event is completely received.\n"},"restrictToHost":{"type":"string","description":"Allows for restricting this input to only accept data from the host specified here.\n","willReplaceOnChanges":true},"source":{"type":"string","description":"Sets the source key/field for events from this input. Defaults to the input file path.\nSets the source key initial value. The key is used during parsing/indexing, in particular to set the source field during indexing. It is also the source field used at search time. As a convenience, the chosen string is prepended with 'source::'.\n"},"sourcetype":{"type":"string","description":"Set the source type for events from this input.\n\"sourcetype=\" is automatically prepended to \u003cstring\u003e.\nDefaults to audittrail (if signedaudit=true) or fschange (if signedaudit=false).\n"}},"stateInputs":{"description":"Input properties used for looking up and filtering InputsTcpRaw resources.\n","properties":{"acl":{"$ref":"#/types/splunk:index/InputsTcpRawAcl:InputsTcpRawAcl","description":"The app/user context that is the namespace for the resource\n"},"connectionHost":{"type":"string","description":"Valid values: (ip | dns | none)\nSet the host for the remote server that is sending data.\nip sets the host to the IP address of the remote server sending data.\ndns sets the host to the reverse DNS entry for the IP address of the remote server sending data.\nnone leaves the host as specified in inputs.conf, which is typically the Splunk system hostname.\nDefault value is dns.\n"},"disabled":{"type":"boolean","description":"Indicates if input is disabled.\n"},"host":{"type":"string","description":"Host from which the indexer gets data.\n"},"index":{"type":"string","description":"Index to store generated events. Defaults to default.\n"},"name":{"type":"string","description":"The input port which receives raw data.\n","willReplaceOnChanges":true},"queue":{"type":"string","description":"Valid values: (parsingQueue | indexQueue)\nSpecifies where the input processor should deposit the events it reads. Defaults to parsingQueue.\nSet queue to parsingQueue to apply props.conf and other parsing rules to your data. For more information about props.conf and rules for timestamping and linebreaking, refer to props.conf and the online documentation at \"Monitor files and directories with inputs.conf\"\nSet queue to indexQueue to send your data directly into the index.\n"},"rawTcpDoneTimeout":{"type":"integer","description":"Specifies in seconds the timeout value for adding a Done-key. Default value is 10 seconds.\nIf a connection over the port specified by name remains idle after receiving data for specified number of seconds, it adds a Done-key. This implies the last event is completely received.\n"},"restrictToHost":{"type":"string","description":"Allows for restricting this input to only accept data from the host specified here.\n","willReplaceOnChanges":true},"source":{"type":"string","description":"Sets the source key/field for events from this input. Defaults to the input file path.\nSets the source key initial value. The key is used during parsing/indexing, in particular to set the source field during indexing. It is also the source field used at search time. As a convenience, the chosen string is prepended with 'source::'.\n"},"sourcetype":{"type":"string","description":"Set the source type for events from this input.\n\"sourcetype=\" is automatically prepended to \u003cstring\u003e.\nDefaults to audittrail (if signedaudit=true) or fschange (if signedaudit=false).\n"}},"type":"object"}},"splunk:index/inputsTcpSplunkTcpToken:InputsTcpSplunkTcpToken":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.InputsTcpSplunkTcpToken\n\" pulumi-lang-dotnet=\" splunk.InputsTcpSplunkTcpToken\n\" pulumi-lang-go=\" InputsTcpSplunkTcpToken\n\" pulumi-lang-python=\" InputsTcpSplunkTcpToken\n\" pulumi-lang-yaml=\" splunk.InputsTcpSplunkTcpToken\n\" pulumi-lang-java=\" splunk.InputsTcpSplunkTcpToken\n\"\u003e splunk.InputsTcpSplunkTcpToken\n\u003c/span\u003e\nManage receiver access using tokens.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst tcpSplunkTcpToken = new splunk.InputsTcpSplunkTcpToken(\"tcp_splunk_tcp_token\", {\n    name: \"new-splunk-tcp-token\",\n    token: \"D66C45B3-7C28-48A1-A13A-027914146501\",\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\ntcp_splunk_tcp_token = splunk.InputsTcpSplunkTcpToken(\"tcp_splunk_tcp_token\",\n    name=\"new-splunk-tcp-token\",\n    token=\"D66C45B3-7C28-48A1-A13A-027914146501\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var tcpSplunkTcpToken = new Splunk.InputsTcpSplunkTcpToken(\"tcp_splunk_tcp_token\", new()\n    {\n        Name = \"new-splunk-tcp-token\",\n        Token = \"D66C45B3-7C28-48A1-A13A-027914146501\",\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewInputsTcpSplunkTcpToken(ctx, \"tcp_splunk_tcp_token\", \u0026splunk.InputsTcpSplunkTcpTokenArgs{\n\t\t\tName:  pulumi.String(\"new-splunk-tcp-token\"),\n\t\t\tToken: pulumi.String(\"D66C45B3-7C28-48A1-A13A-027914146501\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.InputsTcpSplunkTcpToken;\nimport com.pulumi.splunk.InputsTcpSplunkTcpTokenArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var tcpSplunkTcpToken = new InputsTcpSplunkTcpToken(\"tcpSplunkTcpToken\", InputsTcpSplunkTcpTokenArgs.builder()\n            .name(\"new-splunk-tcp-token\")\n            .token(\"D66C45B3-7C28-48A1-A13A-027914146501\")\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  tcpSplunkTcpToken:\n    type: splunk:InputsTcpSplunkTcpToken\n    name: tcp_splunk_tcp_token\n    properties:\n      name: new-splunk-tcp-token\n      token: D66C45B3-7C28-48A1-A13A-027914146501\n```\n\u003c!--End PulumiCodeChooser --\u003e\n","properties":{"acl":{"$ref":"#/types/splunk:index/InputsTcpSplunkTcpTokenAcl:InputsTcpSplunkTcpTokenAcl","description":"The app/user context that is the namespace for the resource\n"},"name":{"type":"string","description":"Required. Name for the token to create.\n"},"token":{"type":"string","description":"Optional. Token value to use. If unspecified, a token is generated automatically.\n"}},"required":["acl","name","token"],"inputProperties":{"acl":{"$ref":"#/types/splunk:index/InputsTcpSplunkTcpTokenAcl:InputsTcpSplunkTcpTokenAcl","description":"The app/user context that is the namespace for the resource\n"},"name":{"type":"string","description":"Required. Name for the token to create.\n","willReplaceOnChanges":true},"token":{"type":"string","description":"Optional. Token value to use. If unspecified, a token is generated automatically.\n"}},"stateInputs":{"description":"Input properties used for looking up and filtering InputsTcpSplunkTcpToken resources.\n","properties":{"acl":{"$ref":"#/types/splunk:index/InputsTcpSplunkTcpTokenAcl:InputsTcpSplunkTcpTokenAcl","description":"The app/user context that is the namespace for the resource\n"},"name":{"type":"string","description":"Required. Name for the token to create.\n","willReplaceOnChanges":true},"token":{"type":"string","description":"Optional. Token value to use. If unspecified, a token is generated automatically.\n"}},"type":"object"}},"splunk:index/inputsTcpSsl:InputsTcpSsl":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.InputsTcpSsl\n\" pulumi-lang-dotnet=\" splunk.InputsTcpSsl\n\" pulumi-lang-go=\" InputsTcpSsl\n\" pulumi-lang-python=\" InputsTcpSsl\n\" pulumi-lang-yaml=\" splunk.InputsTcpSsl\n\" pulumi-lang-java=\" splunk.InputsTcpSsl\n\"\u003e splunk.InputsTcpSsl\n\u003c/span\u003e\nAccess or update the SSL configuration for the host.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst test = new splunk.InputsTcpSsl(\"test\", {\n    disabled: false,\n    requireClientCert: true,\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\ntest = splunk.InputsTcpSsl(\"test\",\n    disabled=False,\n    require_client_cert=True)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var test = new Splunk.InputsTcpSsl(\"test\", new()\n    {\n        Disabled = false,\n        RequireClientCert = true,\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewInputsTcpSsl(ctx, \"test\", \u0026splunk.InputsTcpSslArgs{\n\t\t\tDisabled:          pulumi.Bool(false),\n\t\t\tRequireClientCert: pulumi.Bool(true),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.InputsTcpSsl;\nimport com.pulumi.splunk.InputsTcpSslArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var test = new InputsTcpSsl(\"test\", InputsTcpSslArgs.builder()\n            .disabled(false)\n            .requireClientCert(true)\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  test:\n    type: splunk:InputsTcpSsl\n    properties:\n      disabled: false\n      requireClientCert: true\n```\n\u003c!--End PulumiCodeChooser --\u003e\n","properties":{"disabled":{"type":"boolean","description":"Indicates if input is disabled.\n"},"password":{"type":"string","description":"Server certificate password, if any.\n","secret":true},"requireClientCert":{"type":"boolean","description":"Determines whether a client must authenticate.\n"},"rootCa":{"type":"string","description":"Certificate authority list (root file)\n"},"serverCert":{"type":"string","description":"Full path to the server certificate.\n"}},"required":["disabled","password","requireClientCert","rootCa","serverCert"],"inputProperties":{"disabled":{"type":"boolean","description":"Indicates if input is disabled.\n"},"password":{"type":"string","description":"Server certificate password, if any.\n","secret":true},"requireClientCert":{"type":"boolean","description":"Determines whether a client must authenticate.\n"},"rootCa":{"type":"string","description":"Certificate authority list (root file)\n"},"serverCert":{"type":"string","description":"Full path to the server certificate.\n"}},"stateInputs":{"description":"Input properties used for looking up and filtering InputsTcpSsl resources.\n","properties":{"disabled":{"type":"boolean","description":"Indicates if input is disabled.\n"},"password":{"type":"string","description":"Server certificate password, if any.\n","secret":true},"requireClientCert":{"type":"boolean","description":"Determines whether a client must authenticate.\n"},"rootCa":{"type":"string","description":"Certificate authority list (root file)\n"},"serverCert":{"type":"string","description":"Full path to the server certificate.\n"}},"type":"object"}},"splunk:index/inputsUdp:InputsUdp":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.InputsTcpRaw\n\" pulumi-lang-dotnet=\" splunk.InputsTcpRaw\n\" pulumi-lang-go=\" InputsTcpRaw\n\" pulumi-lang-python=\" InputsTcpRaw\n\" pulumi-lang-yaml=\" splunk.InputsTcpRaw\n\" pulumi-lang-java=\" splunk.InputsTcpRaw\n\"\u003e splunk.InputsTcpRaw\n\u003c/span\u003e\nCreate and manage UDP data inputs.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst udp = new splunk.InputsUdp(\"udp\", {\n    name: \"41000\",\n    index: \"main\",\n    source: \"new\",\n    sourcetype: \"new\",\n    disabled: false,\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\nudp = splunk.InputsUdp(\"udp\",\n    name=\"41000\",\n    index=\"main\",\n    source=\"new\",\n    sourcetype=\"new\",\n    disabled=False)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var udp = new Splunk.InputsUdp(\"udp\", new()\n    {\n        Name = \"41000\",\n        Index = \"main\",\n        Source = \"new\",\n        Sourcetype = \"new\",\n        Disabled = false,\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewInputsUdp(ctx, \"udp\", \u0026splunk.InputsUdpArgs{\n\t\t\tName:       pulumi.String(\"41000\"),\n\t\t\tIndex:      pulumi.String(\"main\"),\n\t\t\tSource:     pulumi.String(\"new\"),\n\t\t\tSourcetype: pulumi.String(\"new\"),\n\t\t\tDisabled:   pulumi.Bool(false),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.InputsUdp;\nimport com.pulumi.splunk.InputsUdpArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var udp = new InputsUdp(\"udp\", InputsUdpArgs.builder()\n            .name(\"41000\")\n            .index(\"main\")\n            .source(\"new\")\n            .sourcetype(\"new\")\n            .disabled(false)\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  udp:\n    type: splunk:InputsUdp\n    properties:\n      name: '41000'\n      index: main\n      source: new\n      sourcetype: new\n      disabled: false\n```\n\u003c!--End PulumiCodeChooser --\u003e\n","properties":{"acl":{"$ref":"#/types/splunk:index/InputsUdpAcl:InputsUdpAcl","description":"The app/user context that is the namespace for the resource\n"},"connectionHost":{"type":"string","description":"Valid values: (ip | dns | none)\nSet the host for the remote server that is sending data.\nip sets the host to the IP address of the remote server sending data.\ndns sets the host to the reverse DNS entry for the IP address of the remote server sending data.\nnone leaves the host as specified in inputs.conf, which is typically the Splunk system hostname.\nDefault value is dns.\n"},"disabled":{"type":"boolean","description":"Indicates if input is disabled.\n"},"host":{"type":"string","description":"The value to populate in the host field for incoming events. This is used during parsing/indexing, in particular to set the host field. It is also the host field used at search time.\n"},"index":{"type":"string","description":"Which index events from this input should be stored in. Defaults to default.\n"},"name":{"type":"string","description":"The UDP port that this input should listen on.\n"},"noAppendingTimestamp":{"type":"boolean","description":"If set to true, prevents Splunk software from prepending a timestamp and hostname to incoming events.\n"},"noPriorityStripping":{"type":"boolean","description":"If set to true, Splunk software does not remove the priority field from incoming syslog events.\n"},"queue":{"type":"string","description":"Which queue events from this input should be sent to. Generally this does not need to be changed.\n"},"restrictToHost":{"type":"string","description":"Restrict incoming connections on this port to the host specified here.\nIf this is not set, the value specified in [udp://\u003cremote server\u003e:\u003cport\u003e] in inputs.conf is used.\n"},"source":{"type":"string","description":"The value to populate in the source field for incoming events. The same source should not be used for multiple data inputs.\n"},"sourcetype":{"type":"string","description":"The value to populate in the sourcetype field for incoming events.\n"}},"required":["acl","connectionHost","disabled","host","index","name","noAppendingTimestamp","noPriorityStripping","queue","restrictToHost","source","sourcetype"],"inputProperties":{"acl":{"$ref":"#/types/splunk:index/InputsUdpAcl:InputsUdpAcl","description":"The app/user context that is the namespace for the resource\n"},"connectionHost":{"type":"string","description":"Valid values: (ip | dns | none)\nSet the host for the remote server that is sending data.\nip sets the host to the IP address of the remote server sending data.\ndns sets the host to the reverse DNS entry for the IP address of the remote server sending data.\nnone leaves the host as specified in inputs.conf, which is typically the Splunk system hostname.\nDefault value is dns.\n"},"disabled":{"type":"boolean","description":"Indicates if input is disabled.\n"},"host":{"type":"string","description":"The value to populate in the host field for incoming events. This is used during parsing/indexing, in particular to set the host field. It is also the host field used at search time.\n"},"index":{"type":"string","description":"Which index events from this input should be stored in. Defaults to default.\n"},"name":{"type":"string","description":"The UDP port that this input should listen on.\n","willReplaceOnChanges":true},"noAppendingTimestamp":{"type":"boolean","description":"If set to true, prevents Splunk software from prepending a timestamp and hostname to incoming events.\n"},"noPriorityStripping":{"type":"boolean","description":"If set to true, Splunk software does not remove the priority field from incoming syslog events.\n"},"queue":{"type":"string","description":"Which queue events from this input should be sent to. Generally this does not need to be changed.\n"},"restrictToHost":{"type":"string","description":"Restrict incoming connections on this port to the host specified here.\nIf this is not set, the value specified in [udp://\u003cremote server\u003e:\u003cport\u003e] in inputs.conf is used.\n"},"source":{"type":"string","description":"The value to populate in the source field for incoming events. The same source should not be used for multiple data inputs.\n"},"sourcetype":{"type":"string","description":"The value to populate in the sourcetype field for incoming events.\n"}},"stateInputs":{"description":"Input properties used for looking up and filtering InputsUdp resources.\n","properties":{"acl":{"$ref":"#/types/splunk:index/InputsUdpAcl:InputsUdpAcl","description":"The app/user context that is the namespace for the resource\n"},"connectionHost":{"type":"string","description":"Valid values: (ip | dns | none)\nSet the host for the remote server that is sending data.\nip sets the host to the IP address of the remote server sending data.\ndns sets the host to the reverse DNS entry for the IP address of the remote server sending data.\nnone leaves the host as specified in inputs.conf, which is typically the Splunk system hostname.\nDefault value is dns.\n"},"disabled":{"type":"boolean","description":"Indicates if input is disabled.\n"},"host":{"type":"string","description":"The value to populate in the host field for incoming events. This is used during parsing/indexing, in particular to set the host field. It is also the host field used at search time.\n"},"index":{"type":"string","description":"Which index events from this input should be stored in. Defaults to default.\n"},"name":{"type":"string","description":"The UDP port that this input should listen on.\n","willReplaceOnChanges":true},"noAppendingTimestamp":{"type":"boolean","description":"If set to true, prevents Splunk software from prepending a timestamp and hostname to incoming events.\n"},"noPriorityStripping":{"type":"boolean","description":"If set to true, Splunk software does not remove the priority field from incoming syslog events.\n"},"queue":{"type":"string","description":"Which queue events from this input should be sent to. Generally this does not need to be changed.\n"},"restrictToHost":{"type":"string","description":"Restrict incoming connections on this port to the host specified here.\nIf this is not set, the value specified in [udp://\u003cremote server\u003e:\u003cport\u003e] in inputs.conf is used.\n"},"source":{"type":"string","description":"The value to populate in the source field for incoming events. The same source should not be used for multiple data inputs.\n"},"sourcetype":{"type":"string","description":"The value to populate in the sourcetype field for incoming events.\n"}},"type":"object"}},"splunk:index/lookupDefinition:LookupDefinition":{"description":"## \n\n# Resource:\u003cspan pulumi-lang-nodejs=\" splunk.LookupDefinition\n\" pulumi-lang-dotnet=\" splunk.LookupDefinition\n\" pulumi-lang-go=\" LookupDefinition\n\" pulumi-lang-python=\" LookupDefinition\n\" pulumi-lang-yaml=\" splunk.LookupDefinition\n\" pulumi-lang-java=\" splunk.LookupDefinition\n\"\u003e splunk.LookupDefinition\n\u003c/span\u003e\nManage lookup definitions in Splunk. For more information on lookup definitions, refer to the official Splunk documentation: https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutlookupsandfieldactions\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst example = new splunk.LookupDefinition(\"example\", {\n    name: \"example_lookup_definition\",\n    filename: \"example_lookup_file.csv\",\n    acl: {\n        owner: \"admin\",\n        app: \"search\",\n        sharing: \"app\",\n        reads: [\"*\"],\n        writes: [\"admin\"],\n    },\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\nexample = splunk.LookupDefinition(\"example\",\n    name=\"example_lookup_definition\",\n    filename=\"example_lookup_file.csv\",\n    acl={\n        \"owner\": \"admin\",\n        \"app\": \"search\",\n        \"sharing\": \"app\",\n        \"reads\": [\"*\"],\n        \"writes\": [\"admin\"],\n    })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var example = new Splunk.LookupDefinition(\"example\", new()\n    {\n        Name = \"example_lookup_definition\",\n        Filename = \"example_lookup_file.csv\",\n        Acl = new Splunk.Inputs.LookupDefinitionAclArgs\n        {\n            Owner = \"admin\",\n            App = \"search\",\n            Sharing = \"app\",\n            Reads = new[]\n            {\n                \"*\",\n            },\n            Writes = new[]\n            {\n                \"admin\",\n            },\n        },\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewLookupDefinition(ctx, \"example\", \u0026splunk.LookupDefinitionArgs{\n\t\t\tName:     pulumi.String(\"example_lookup_definition\"),\n\t\t\tFilename: pulumi.String(\"example_lookup_file.csv\"),\n\t\t\tAcl: \u0026splunk.LookupDefinitionAclArgs{\n\t\t\t\tOwner:   pulumi.String(\"admin\"),\n\t\t\t\tApp:     pulumi.String(\"search\"),\n\t\t\t\tSharing: pulumi.String(\"app\"),\n\t\t\t\tReads: pulumi.StringArray{\n\t\t\t\t\tpulumi.String(\"*\"),\n\t\t\t\t},\n\t\t\t\tWrites: pulumi.StringArray{\n\t\t\t\t\tpulumi.String(\"admin\"),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.LookupDefinition;\nimport com.pulumi.splunk.LookupDefinitionArgs;\nimport com.pulumi.splunk.inputs.LookupDefinitionAclArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var example = new LookupDefinition(\"example\", LookupDefinitionArgs.builder()\n            .name(\"example_lookup_definition\")\n            .filename(\"example_lookup_file.csv\")\n            .acl(LookupDefinitionAclArgs.builder()\n                .owner(\"admin\")\n                .app(\"search\")\n                .sharing(\"app\")\n                .reads(\"*\")\n                .writes(\"admin\")\n                .build())\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  example:\n    type: splunk:LookupDefinition\n    properties:\n      name: example_lookup_definition\n      filename: example_lookup_file.csv\n      acl:\n        owner: admin\n        app: search\n        sharing: app\n        reads:\n          - '*'\n        writes:\n          - admin\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Validation Rules\n\nWhen `acl.sharing` is set to \u003cspan pulumi-lang-nodejs=\"`user`\" pulumi-lang-dotnet=\"`User`\" pulumi-lang-go=\"`user`\" pulumi-lang-python=\"`user`\" pulumi-lang-yaml=\"`user`\" pulumi-lang-java=\"`user`\"\u003e`user`\u003c/span\u003e, the `acl.read` and `acl.write` fields must not be explicitly set. Setting them will trigger a validation error.\n","properties":{"acl":{"$ref":"#/types/splunk:index/LookupDefinitionAcl:LookupDefinitionAcl","description":"Defines the access control list (ACL) for the lookup definition. See acl.md for more details.\n"},"filename":{"type":"string","description":"The filename for the lookup table, usually ending in `.csv`.\n"},"name":{"type":"string","description":"A unique name for the lookup definition within the app context.\n"}},"required":["acl","filename","name"],"inputProperties":{"acl":{"$ref":"#/types/splunk:index/LookupDefinitionAcl:LookupDefinitionAcl","description":"Defines the access control list (ACL) for the lookup definition. See acl.md for more details.\n"},"filename":{"type":"string","description":"The filename for the lookup table, usually ending in `.csv`.\n"},"name":{"type":"string","description":"A unique name for the lookup definition within the app context.\n","willReplaceOnChanges":true}},"requiredInputs":["filename","name"],"stateInputs":{"description":"Input properties used for looking up and filtering LookupDefinition resources.\n","properties":{"acl":{"$ref":"#/types/splunk:index/LookupDefinitionAcl:LookupDefinitionAcl","description":"Defines the access control list (ACL) for the lookup definition. See acl.md for more details.\n"},"filename":{"type":"string","description":"The filename for the lookup table, usually ending in `.csv`.\n"},"name":{"type":"string","description":"A unique name for the lookup definition within the app context.\n","willReplaceOnChanges":true}},"type":"object"}},"splunk:index/lookupTableFile:LookupTableFile":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.LookupTableFile\n\" pulumi-lang-dotnet=\" splunk.LookupTableFile\n\" pulumi-lang-go=\" LookupTableFile\n\" pulumi-lang-python=\" LookupTableFile\n\" pulumi-lang-yaml=\" splunk.LookupTableFile\n\" pulumi-lang-java=\" splunk.LookupTableFile\n\"\u003e splunk.LookupTableFile\n\u003c/span\u003e\nCreate and manage lookup table files.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst lookupTableFile = new splunk.LookupTableFile(\"lookup_table_file\", {\n    app: \"search\",\n    owner: \"nobody\",\n    fileName: \"lookup.csv\",\n    fileContents: [\n        [\n            \"status\",\n            \"status_description\",\n            \"status_type\",\n        ],\n        [\n            \"100\",\n            \"Continue\",\n            \"Informational\",\n        ],\n        [\n            \"101\",\n            \"Switching Protocols\",\n            \"Informational\",\n        ],\n        [\n            \"200\",\n            \"OK\",\n            \"Successful\",\n        ],\n    ],\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\nlookup_table_file = splunk.LookupTableFile(\"lookup_table_file\",\n    app=\"search\",\n    owner=\"nobody\",\n    file_name=\"lookup.csv\",\n    file_contents=[\n        [\n            \"status\",\n            \"status_description\",\n            \"status_type\",\n        ],\n        [\n            \"100\",\n            \"Continue\",\n            \"Informational\",\n        ],\n        [\n            \"101\",\n            \"Switching Protocols\",\n            \"Informational\",\n        ],\n        [\n            \"200\",\n            \"OK\",\n            \"Successful\",\n        ],\n    ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var lookupTableFile = new Splunk.LookupTableFile(\"lookup_table_file\", new()\n    {\n        App = \"search\",\n        Owner = \"nobody\",\n        FileName = \"lookup.csv\",\n        FileContents = new[]\n        {\n            new[]\n            {\n                \"status\",\n                \"status_description\",\n                \"status_type\",\n            },\n            new[]\n            {\n                \"100\",\n                \"Continue\",\n                \"Informational\",\n            },\n            new[]\n            {\n                \"101\",\n                \"Switching Protocols\",\n                \"Informational\",\n            },\n            new[]\n            {\n                \"200\",\n                \"OK\",\n                \"Successful\",\n            },\n        },\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewLookupTableFile(ctx, \"lookup_table_file\", \u0026splunk.LookupTableFileArgs{\n\t\t\tApp:      pulumi.String(\"search\"),\n\t\t\tOwner:    pulumi.String(\"nobody\"),\n\t\t\tFileName: pulumi.String(\"lookup.csv\"),\n\t\t\tFileContents: pulumi.StringArrayArray{\n\t\t\t\tpulumi.StringArray{\n\t\t\t\t\tpulumi.String(\"status\"),\n\t\t\t\t\tpulumi.String(\"status_description\"),\n\t\t\t\t\tpulumi.String(\"status_type\"),\n\t\t\t\t},\n\t\t\t\tpulumi.StringArray{\n\t\t\t\t\tpulumi.String(\"100\"),\n\t\t\t\t\tpulumi.String(\"Continue\"),\n\t\t\t\t\tpulumi.String(\"Informational\"),\n\t\t\t\t},\n\t\t\t\tpulumi.StringArray{\n\t\t\t\t\tpulumi.String(\"101\"),\n\t\t\t\t\tpulumi.String(\"Switching Protocols\"),\n\t\t\t\t\tpulumi.String(\"Informational\"),\n\t\t\t\t},\n\t\t\t\tpulumi.StringArray{\n\t\t\t\t\tpulumi.String(\"200\"),\n\t\t\t\t\tpulumi.String(\"OK\"),\n\t\t\t\t\tpulumi.String(\"Successful\"),\n\t\t\t\t},\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.LookupTableFile;\nimport com.pulumi.splunk.LookupTableFileArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var lookupTableFile = new LookupTableFile(\"lookupTableFile\", LookupTableFileArgs.builder()\n            .app(\"search\")\n            .owner(\"nobody\")\n            .fileName(\"lookup.csv\")\n            .fileContents(            \n                                \n                    \"status\",\n                    \"status_description\",\n                    \"status_type\",\n                                \n                    \"100\",\n                    \"Continue\",\n                    \"Informational\",\n                                \n                    \"101\",\n                    \"Switching Protocols\",\n                    \"Informational\",\n                                \n                    \"200\",\n                    \"OK\",\n                    \"Successful\")\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  lookupTableFile:\n    type: splunk:LookupTableFile\n    name: lookup_table_file\n    properties:\n      app: search\n      owner: nobody\n      fileName: lookup.csv\n      fileContents:\n        - - status\n          - status_description\n          - status_type\n        - - '100'\n          - Continue\n          - Informational\n        - - '101'\n          - Switching Protocols\n          - Informational\n        - - '200'\n          - OK\n          - Successful\n```\n\u003c!--End PulumiCodeChooser --\u003e\n","properties":{"app":{"type":"string","description":"The app context for the resource.\n"},"fileContents":{"type":"array","items":{"type":"array","items":{"type":"string"}},"description":"The column header and row value contents for the lookup table file.\n"},"fileName":{"type":"string","description":"A name for the lookup table file. Generally ends with \".csv\"\n"},"owner":{"type":"string","description":"User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties. nobody = All users may access the resource, but write access to the resource might be restricted.\n"}},"required":["app","fileContents","fileName","owner"],"inputProperties":{"app":{"type":"string","description":"The app context for the resource.\n","willReplaceOnChanges":true},"fileContents":{"type":"array","items":{"type":"array","items":{"type":"string"}},"description":"The column header and row value contents for the lookup table file.\n"},"fileName":{"type":"string","description":"A name for the lookup table file. Generally ends with \".csv\"\n","willReplaceOnChanges":true},"owner":{"type":"string","description":"User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties. nobody = All users may access the resource, but write access to the resource might be restricted.\n","willReplaceOnChanges":true}},"requiredInputs":["app","fileContents","fileName","owner"],"stateInputs":{"description":"Input properties used for looking up and filtering LookupTableFile resources.\n","properties":{"app":{"type":"string","description":"The app context for the resource.\n","willReplaceOnChanges":true},"fileContents":{"type":"array","items":{"type":"array","items":{"type":"string"}},"description":"The column header and row value contents for the lookup table file.\n"},"fileName":{"type":"string","description":"A name for the lookup table file. Generally ends with \".csv\"\n","willReplaceOnChanges":true},"owner":{"type":"string","description":"User name of resource owner. Defaults to the resource creator. Required for updating any knowledge object ACL properties. nobody = All users may access the resource, but write access to the resource might be restricted.\n","willReplaceOnChanges":true}},"type":"object"}},"splunk:index/outputsTcpDefault:OutputsTcpDefault":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.OutputsTcpDefault\n\" pulumi-lang-dotnet=\" splunk.OutputsTcpDefault\n\" pulumi-lang-go=\" OutputsTcpDefault\n\" pulumi-lang-python=\" OutputsTcpDefault\n\" pulumi-lang-yaml=\" splunk.OutputsTcpDefault\n\" pulumi-lang-java=\" splunk.OutputsTcpDefault\n\"\u003e splunk.OutputsTcpDefault\n\u003c/span\u003e\nManage to global tcpout properties.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst tcpDefault = new splunk.OutputsTcpDefault(\"tcp_default\", {\n    name: \"tcpout\",\n    disabled: false,\n    defaultGroup: \"test-indexers\",\n    dropEventsOnQueueFull: 60,\n    indexAndForward: true,\n    sendCookedData: true,\n    maxQueueSize: \"100KB\",\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\ntcp_default = splunk.OutputsTcpDefault(\"tcp_default\",\n    name=\"tcpout\",\n    disabled=False,\n    default_group=\"test-indexers\",\n    drop_events_on_queue_full=60,\n    index_and_forward=True,\n    send_cooked_data=True,\n    max_queue_size=\"100KB\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var tcpDefault = new Splunk.OutputsTcpDefault(\"tcp_default\", new()\n    {\n        Name = \"tcpout\",\n        Disabled = false,\n        DefaultGroup = \"test-indexers\",\n        DropEventsOnQueueFull = 60,\n        IndexAndForward = true,\n        SendCookedData = true,\n        MaxQueueSize = \"100KB\",\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewOutputsTcpDefault(ctx, \"tcp_default\", \u0026splunk.OutputsTcpDefaultArgs{\n\t\t\tName:                  pulumi.String(\"tcpout\"),\n\t\t\tDisabled:              pulumi.Bool(false),\n\t\t\tDefaultGroup:          pulumi.String(\"test-indexers\"),\n\t\t\tDropEventsOnQueueFull: pulumi.Int(60),\n\t\t\tIndexAndForward:       pulumi.Bool(true),\n\t\t\tSendCookedData:        pulumi.Bool(true),\n\t\t\tMaxQueueSize:          pulumi.String(\"100KB\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.OutputsTcpDefault;\nimport com.pulumi.splunk.OutputsTcpDefaultArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var tcpDefault = new OutputsTcpDefault(\"tcpDefault\", OutputsTcpDefaultArgs.builder()\n            .name(\"tcpout\")\n            .disabled(false)\n            .defaultGroup(\"test-indexers\")\n            .dropEventsOnQueueFull(60)\n            .indexAndForward(true)\n            .sendCookedData(true)\n            .maxQueueSize(\"100KB\")\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  tcpDefault:\n    type: splunk:OutputsTcpDefault\n    name: tcp_default\n    properties:\n      name: tcpout\n      disabled: false\n      defaultGroup: test-indexers\n      dropEventsOnQueueFull: 60\n      indexAndForward: true\n      sendCookedData: true\n      maxQueueSize: 100KB\n```\n\u003c!--End PulumiCodeChooser --\u003e\n","properties":{"acl":{"$ref":"#/types/splunk:index/OutputsTcpDefaultAcl:OutputsTcpDefaultAcl","description":"The app/user context that is the namespace for the resource\n"},"defaultGroup":{"type":"string","description":"Comma-separated list of one or more target group names, specified later in [tcpout:\u003ctarget_group\u003e] stanzas of outputs.conf.spec file.\nThe forwarder sends all data to the specified groups. If you do not want to forward data automatically, do not set this attribute. Can be overridden by an inputs.conf _TCP_ROUTING setting, which in turn can be overridden by a props.conf/transforms.conf modifier.\n"},"disabled":{"type":"boolean","description":"Disables default tcpout settings\n"},"dropEventsOnQueueFull":{"type":"integer","description":"If set to a positive number, wait the specified number of seconds before throwing out all new events until the output queue has space. Defaults to -1 (do not drop events).\n\u003cbr\u003eCAUTION: Do not set this value to a positive integer if you are monitoring files.\nSetting this to -1 or 0 causes the output queue to block when it gets full, which causes further blocking up the processing chain. If any target group queue is blocked, no more data reaches any other target group.\nUsing auto load-balancing is the best way to minimize this condition, because, in that case, multiple receivers must be down (or jammed up) before queue blocking can occur.\n"},"heartbeatFrequency":{"type":"integer","description":"How often (in seconds) to send a heartbeat packet to the receiving server.\nHeartbeats are only sent if sendCookedData=true. Defaults to 30 seconds.\n"},"indexAndForward":{"type":"boolean","description":"Specifies whether to index all data locally, in addition to forwarding it. Defaults to false.\nThis is known as an \"index-and-forward\" configuration. This attribute is only available for heavy forwarders. It is available only at the top level [tcpout] stanza in outputs.conf. It cannot be overridden in a target group.\n"},"maxQueueSize":{"type":"string","description":"Specify an integer or integer[KB|MB|GB].\n\u003cbr\u003eSets the maximum size of the forwarder output queue. It also sets the maximum size of the wait queue to 3x this value, if you have enabled indexer acknowledgment (useACK=true).\nAlthough the wait queue and the output queues are both configured by this attribute, they are separate queues. The setting determines the maximum size of the queue in-memory (RAM) buffer.\nFor heavy forwarders sending parsed data, maxQueueSize is the maximum number of events. Since events are typically much shorter than data blocks, the memory consumed by the queue on a parsing forwarder is likely to be much smaller than on a non-parsing forwarder, if you use this version of the setting.\nIf specified as a lone integer (for example, maxQueueSize=100), maxQueueSize indicates the maximum number of queued events (for parsed data) or blocks of data (for unparsed data). A block of data is approximately 64KB. For non-parsing forwarders, such as universal forwarders, that send unparsed data, maxQueueSize is the maximum number of data blocks.\nIf specified as an integer followed by KB, MB, or GB (for example, maxQueueSize=100MB), maxQueueSize indicates the maximum RAM allocated to the queue buffer. Defaults to 500KB (which means a maximum size of 500KB for the output queue and 1500KB for the wait queue, if any).\n"},"name":{"type":"string","description":"Configuration to be edited. The only valid value is \"tcpout\".\n"},"sendCookedData":{"type":"boolean","description":"If true, events are cooked (processed by Splunk software). If false, events are raw and untouched prior to sending. Defaults to true.\nSet to false if you are sending to a third-party system.\n"}},"required":["acl","defaultGroup","disabled","dropEventsOnQueueFull","heartbeatFrequency","indexAndForward","maxQueueSize","name","sendCookedData"],"inputProperties":{"acl":{"$ref":"#/types/splunk:index/OutputsTcpDefaultAcl:OutputsTcpDefaultAcl","description":"The app/user context that is the namespace for the resource\n"},"defaultGroup":{"type":"string","description":"Comma-separated list of one or more target group names, specified later in [tcpout:\u003ctarget_group\u003e] stanzas of outputs.conf.spec file.\nThe forwarder sends all data to the specified groups. If you do not want to forward data automatically, do not set this attribute. Can be overridden by an inputs.conf _TCP_ROUTING setting, which in turn can be overridden by a props.conf/transforms.conf modifier.\n"},"disabled":{"type":"boolean","description":"Disables default tcpout settings\n"},"dropEventsOnQueueFull":{"type":"integer","description":"If set to a positive number, wait the specified number of seconds before throwing out all new events until the output queue has space. Defaults to -1 (do not drop events).\n\u003cbr\u003eCAUTION: Do not set this value to a positive integer if you are monitoring files.\nSetting this to -1 or 0 causes the output queue to block when it gets full, which causes further blocking up the processing chain. If any target group queue is blocked, no more data reaches any other target group.\nUsing auto load-balancing is the best way to minimize this condition, because, in that case, multiple receivers must be down (or jammed up) before queue blocking can occur.\n"},"heartbeatFrequency":{"type":"integer","description":"How often (in seconds) to send a heartbeat packet to the receiving server.\nHeartbeats are only sent if sendCookedData=true. Defaults to 30 seconds.\n"},"indexAndForward":{"type":"boolean","description":"Specifies whether to index all data locally, in addition to forwarding it. Defaults to false.\nThis is known as an \"index-and-forward\" configuration. This attribute is only available for heavy forwarders. It is available only at the top level [tcpout] stanza in outputs.conf. It cannot be overridden in a target group.\n"},"maxQueueSize":{"type":"string","description":"Specify an integer or integer[KB|MB|GB].\n\u003cbr\u003eSets the maximum size of the forwarder output queue. It also sets the maximum size of the wait queue to 3x this value, if you have enabled indexer acknowledgment (useACK=true).\nAlthough the wait queue and the output queues are both configured by this attribute, they are separate queues. The setting determines the maximum size of the queue in-memory (RAM) buffer.\nFor heavy forwarders sending parsed data, maxQueueSize is the maximum number of events. Since events are typically much shorter than data blocks, the memory consumed by the queue on a parsing forwarder is likely to be much smaller than on a non-parsing forwarder, if you use this version of the setting.\nIf specified as a lone integer (for example, maxQueueSize=100), maxQueueSize indicates the maximum number of queued events (for parsed data) or blocks of data (for unparsed data). A block of data is approximately 64KB. For non-parsing forwarders, such as universal forwarders, that send unparsed data, maxQueueSize is the maximum number of data blocks.\nIf specified as an integer followed by KB, MB, or GB (for example, maxQueueSize=100MB), maxQueueSize indicates the maximum RAM allocated to the queue buffer. Defaults to 500KB (which means a maximum size of 500KB for the output queue and 1500KB for the wait queue, if any).\n"},"name":{"type":"string","description":"Configuration to be edited. The only valid value is \"tcpout\".\n"},"sendCookedData":{"type":"boolean","description":"If true, events are cooked (processed by Splunk software). If false, events are raw and untouched prior to sending. Defaults to true.\nSet to false if you are sending to a third-party system.\n"}},"stateInputs":{"description":"Input properties used for looking up and filtering OutputsTcpDefault resources.\n","properties":{"acl":{"$ref":"#/types/splunk:index/OutputsTcpDefaultAcl:OutputsTcpDefaultAcl","description":"The app/user context that is the namespace for the resource\n"},"defaultGroup":{"type":"string","description":"Comma-separated list of one or more target group names, specified later in [tcpout:\u003ctarget_group\u003e] stanzas of outputs.conf.spec file.\nThe forwarder sends all data to the specified groups. If you do not want to forward data automatically, do not set this attribute. Can be overridden by an inputs.conf _TCP_ROUTING setting, which in turn can be overridden by a props.conf/transforms.conf modifier.\n"},"disabled":{"type":"boolean","description":"Disables default tcpout settings\n"},"dropEventsOnQueueFull":{"type":"integer","description":"If set to a positive number, wait the specified number of seconds before throwing out all new events until the output queue has space. Defaults to -1 (do not drop events).\n\u003cbr\u003eCAUTION: Do not set this value to a positive integer if you are monitoring files.\nSetting this to -1 or 0 causes the output queue to block when it gets full, which causes further blocking up the processing chain. If any target group queue is blocked, no more data reaches any other target group.\nUsing auto load-balancing is the best way to minimize this condition, because, in that case, multiple receivers must be down (or jammed up) before queue blocking can occur.\n"},"heartbeatFrequency":{"type":"integer","description":"How often (in seconds) to send a heartbeat packet to the receiving server.\nHeartbeats are only sent if sendCookedData=true. Defaults to 30 seconds.\n"},"indexAndForward":{"type":"boolean","description":"Specifies whether to index all data locally, in addition to forwarding it. Defaults to false.\nThis is known as an \"index-and-forward\" configuration. This attribute is only available for heavy forwarders. It is available only at the top level [tcpout] stanza in outputs.conf. It cannot be overridden in a target group.\n"},"maxQueueSize":{"type":"string","description":"Specify an integer or integer[KB|MB|GB].\n\u003cbr\u003eSets the maximum size of the forwarder output queue. It also sets the maximum size of the wait queue to 3x this value, if you have enabled indexer acknowledgment (useACK=true).\nAlthough the wait queue and the output queues are both configured by this attribute, they are separate queues. The setting determines the maximum size of the queue in-memory (RAM) buffer.\nFor heavy forwarders sending parsed data, maxQueueSize is the maximum number of events. Since events are typically much shorter than data blocks, the memory consumed by the queue on a parsing forwarder is likely to be much smaller than on a non-parsing forwarder, if you use this version of the setting.\nIf specified as a lone integer (for example, maxQueueSize=100), maxQueueSize indicates the maximum number of queued events (for parsed data) or blocks of data (for unparsed data). A block of data is approximately 64KB. For non-parsing forwarders, such as universal forwarders, that send unparsed data, maxQueueSize is the maximum number of data blocks.\nIf specified as an integer followed by KB, MB, or GB (for example, maxQueueSize=100MB), maxQueueSize indicates the maximum RAM allocated to the queue buffer. Defaults to 500KB (which means a maximum size of 500KB for the output queue and 1500KB for the wait queue, if any).\n"},"name":{"type":"string","description":"Configuration to be edited. The only valid value is \"tcpout\".\n"},"sendCookedData":{"type":"boolean","description":"If true, events are cooked (processed by Splunk software). If false, events are raw and untouched prior to sending. Defaults to true.\nSet to false if you are sending to a third-party system.\n"}},"type":"object"}},"splunk:index/outputsTcpGroup:OutputsTcpGroup":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.OutputsTcpGroup\n\" pulumi-lang-dotnet=\" splunk.OutputsTcpGroup\n\" pulumi-lang-go=\" OutputsTcpGroup\n\" pulumi-lang-python=\" OutputsTcpGroup\n\" pulumi-lang-yaml=\" splunk.OutputsTcpGroup\n\" pulumi-lang-java=\" splunk.OutputsTcpGroup\n\"\u003e splunk.OutputsTcpGroup\n\u003c/span\u003e\nAccess to the configuration of a group of one or more data forwarding destinations.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst tcpGroup = new splunk.OutputsTcpGroup(\"tcp_group\", {\n    name: \"tcp-group\",\n    disabled: false,\n    dropEventsOnQueueFull: 60,\n    sendCookedData: true,\n    maxQueueSize: \"100KB\",\n    servers: [\n        \"1.1.1.1:1234\",\n        \"2.2.2.2:1234\",\n    ],\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\ntcp_group = splunk.OutputsTcpGroup(\"tcp_group\",\n    name=\"tcp-group\",\n    disabled=False,\n    drop_events_on_queue_full=60,\n    send_cooked_data=True,\n    max_queue_size=\"100KB\",\n    servers=[\n        \"1.1.1.1:1234\",\n        \"2.2.2.2:1234\",\n    ])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var tcpGroup = new Splunk.OutputsTcpGroup(\"tcp_group\", new()\n    {\n        Name = \"tcp-group\",\n        Disabled = false,\n        DropEventsOnQueueFull = 60,\n        SendCookedData = true,\n        MaxQueueSize = \"100KB\",\n        Servers = new[]\n        {\n            \"1.1.1.1:1234\",\n            \"2.2.2.2:1234\",\n        },\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewOutputsTcpGroup(ctx, \"tcp_group\", \u0026splunk.OutputsTcpGroupArgs{\n\t\t\tName:                  pulumi.String(\"tcp-group\"),\n\t\t\tDisabled:              pulumi.Bool(false),\n\t\t\tDropEventsOnQueueFull: pulumi.Int(60),\n\t\t\tSendCookedData:        pulumi.Bool(true),\n\t\t\tMaxQueueSize:          pulumi.String(\"100KB\"),\n\t\t\tServers: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"1.1.1.1:1234\"),\n\t\t\t\tpulumi.String(\"2.2.2.2:1234\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.OutputsTcpGroup;\nimport com.pulumi.splunk.OutputsTcpGroupArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var tcpGroup = new OutputsTcpGroup(\"tcpGroup\", OutputsTcpGroupArgs.builder()\n            .name(\"tcp-group\")\n            .disabled(false)\n            .dropEventsOnQueueFull(60)\n            .sendCookedData(true)\n            .maxQueueSize(\"100KB\")\n            .servers(            \n                \"1.1.1.1:1234\",\n                \"2.2.2.2:1234\")\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  tcpGroup:\n    type: splunk:OutputsTcpGroup\n    name: tcp_group\n    properties:\n      name: tcp-group\n      disabled: false\n      dropEventsOnQueueFull: 60\n      sendCookedData: true\n      maxQueueSize: 100KB\n      servers:\n        - 1.1.1.1:1234\n        - 2.2.2.2:1234\n```\n\u003c!--End PulumiCodeChooser --\u003e\n","properties":{"acl":{"$ref":"#/types/splunk:index/OutputsTcpGroupAcl:OutputsTcpGroupAcl","description":"The app/user context that is the namespace for the resource\n"},"compressed":{"type":"boolean","description":"If true, forwarder sends compressed data. If set to true, the receiver port must also have compression turned on.\n"},"disabled":{"type":"boolean","description":"If true, disables the group.\n"},"dropEventsOnQueueFull":{"type":"integer","description":"If set to a positive number, wait the specified number of seconds before throwing out all new events until the output queue has space. Defaults to -1 (do not drop events).\n\u003cbr\u003eCAUTION: Do not set this value to a positive integer if you are monitoring files.\nSetting this to -1 or 0 causes the output queue to block when it gets full, which causes further blocking up the processing chain. If any target group queue is blocked, no more data reaches any other target group.\nUsing auto load-balancing is the best way to minimize this condition, because, in that case, multiple receivers must be down (or jammed up) before queue blocking can occur.\n"},"heartbeatFrequency":{"type":"integer","description":"How often (in seconds) to send a heartbeat packet to the receiving server.\nHeartbeats are only sent if sendCookedData=true. Defaults to 30 seconds.\n"},"maxQueueSize":{"type":"string","description":"Specify an integer or integer[KB|MB|GB].\n\u003cbr\u003eSets the maximum size of the forwarder output queue. It also sets the maximum size of the wait queue to 3x this value, if you have enabled indexer acknowledgment (useACK=true).\nAlthough the wait queue and the output queues are both configured by this attribute, they are separate queues. The setting determines the maximum size of the queue in-memory (RAM) buffer.\nFor heavy forwarders sending parsed data, maxQueueSize is the maximum number of events. Since events are typically much shorter than data blocks, the memory consumed by the queue on a parsing forwarder is likely to be much smaller than on a non-parsing forwarder, if you use this version of the setting.\nIf specified as a lone integer (for example, maxQueueSize=100), maxQueueSize indicates the maximum number of queued events (for parsed data) or blocks of data (for unparsed data). A block of data is approximately 64KB. For non-parsing forwarders, such as universal forwarders, that send unparsed data, maxQueueSize is the maximum number of data blocks.\nIf specified as an integer followed by KB, MB, or GB (for example, maxQueueSize=100MB), maxQueueSize indicates the maximum RAM allocated to the queue buffer. Defaults to 500KB (which means a maximum size of 500KB for the output queue and 1500KB for the wait queue, if any).\n"},"method":{"type":"string","description":"Valid values: (tcpout | syslog). Specifies the type of output processor.\n"},"name":{"type":"string","description":"The name of the group of receivers.\n"},"sendCookedData":{"type":"boolean","description":"If true, events are cooked (processed by Splunk software). If false, events are raw and untouched prior to sending. Defaults to true.\nSet to false if you are sending to a third-party system.\n"},"servers":{"type":"array","items":{"type":"string"},"description":"Comma-separated list of servers to include in the group.\n"},"token":{"type":"string","description":"Token value generated by the indexer after configuration.\n"}},"required":["acl","compressed","disabled","dropEventsOnQueueFull","heartbeatFrequency","maxQueueSize","method","name","sendCookedData","servers","token"],"inputProperties":{"acl":{"$ref":"#/types/splunk:index/OutputsTcpGroupAcl:OutputsTcpGroupAcl","description":"The app/user context that is the namespace for the resource\n"},"compressed":{"type":"boolean","description":"If true, forwarder sends compressed data. If set to true, the receiver port must also have compression turned on.\n"},"disabled":{"type":"boolean","description":"If true, disables the group.\n"},"dropEventsOnQueueFull":{"type":"integer","description":"If set to a positive number, wait the specified number of seconds before throwing out all new events until the output queue has space. Defaults to -1 (do not drop events).\n\u003cbr\u003eCAUTION: Do not set this value to a positive integer if you are monitoring files.\nSetting this to -1 or 0 causes the output queue to block when it gets full, which causes further blocking up the processing chain. If any target group queue is blocked, no more data reaches any other target group.\nUsing auto load-balancing is the best way to minimize this condition, because, in that case, multiple receivers must be down (or jammed up) before queue blocking can occur.\n"},"heartbeatFrequency":{"type":"integer","description":"How often (in seconds) to send a heartbeat packet to the receiving server.\nHeartbeats are only sent if sendCookedData=true. Defaults to 30 seconds.\n"},"maxQueueSize":{"type":"string","description":"Specify an integer or integer[KB|MB|GB].\n\u003cbr\u003eSets the maximum size of the forwarder output queue. It also sets the maximum size of the wait queue to 3x this value, if you have enabled indexer acknowledgment (useACK=true).\nAlthough the wait queue and the output queues are both configured by this attribute, they are separate queues. The setting determines the maximum size of the queue in-memory (RAM) buffer.\nFor heavy forwarders sending parsed data, maxQueueSize is the maximum number of events. Since events are typically much shorter than data blocks, the memory consumed by the queue on a parsing forwarder is likely to be much smaller than on a non-parsing forwarder, if you use this version of the setting.\nIf specified as a lone integer (for example, maxQueueSize=100), maxQueueSize indicates the maximum number of queued events (for parsed data) or blocks of data (for unparsed data). A block of data is approximately 64KB. For non-parsing forwarders, such as universal forwarders, that send unparsed data, maxQueueSize is the maximum number of data blocks.\nIf specified as an integer followed by KB, MB, or GB (for example, maxQueueSize=100MB), maxQueueSize indicates the maximum RAM allocated to the queue buffer. Defaults to 500KB (which means a maximum size of 500KB for the output queue and 1500KB for the wait queue, if any).\n"},"method":{"type":"string","description":"Valid values: (tcpout | syslog). Specifies the type of output processor.\n"},"name":{"type":"string","description":"The name of the group of receivers.\n","willReplaceOnChanges":true},"sendCookedData":{"type":"boolean","description":"If true, events are cooked (processed by Splunk software). If false, events are raw and untouched prior to sending. Defaults to true.\nSet to false if you are sending to a third-party system.\n"},"servers":{"type":"array","items":{"type":"string"},"description":"Comma-separated list of servers to include in the group.\n"},"token":{"type":"string","description":"Token value generated by the indexer after configuration.\n"}},"requiredInputs":["servers"],"stateInputs":{"description":"Input properties used for looking up and filtering OutputsTcpGroup resources.\n","properties":{"acl":{"$ref":"#/types/splunk:index/OutputsTcpGroupAcl:OutputsTcpGroupAcl","description":"The app/user context that is the namespace for the resource\n"},"compressed":{"type":"boolean","description":"If true, forwarder sends compressed data. If set to true, the receiver port must also have compression turned on.\n"},"disabled":{"type":"boolean","description":"If true, disables the group.\n"},"dropEventsOnQueueFull":{"type":"integer","description":"If set to a positive number, wait the specified number of seconds before throwing out all new events until the output queue has space. Defaults to -1 (do not drop events).\n\u003cbr\u003eCAUTION: Do not set this value to a positive integer if you are monitoring files.\nSetting this to -1 or 0 causes the output queue to block when it gets full, which causes further blocking up the processing chain. If any target group queue is blocked, no more data reaches any other target group.\nUsing auto load-balancing is the best way to minimize this condition, because, in that case, multiple receivers must be down (or jammed up) before queue blocking can occur.\n"},"heartbeatFrequency":{"type":"integer","description":"How often (in seconds) to send a heartbeat packet to the receiving server.\nHeartbeats are only sent if sendCookedData=true. Defaults to 30 seconds.\n"},"maxQueueSize":{"type":"string","description":"Specify an integer or integer[KB|MB|GB].\n\u003cbr\u003eSets the maximum size of the forwarder output queue. It also sets the maximum size of the wait queue to 3x this value, if you have enabled indexer acknowledgment (useACK=true).\nAlthough the wait queue and the output queues are both configured by this attribute, they are separate queues. The setting determines the maximum size of the queue in-memory (RAM) buffer.\nFor heavy forwarders sending parsed data, maxQueueSize is the maximum number of events. Since events are typically much shorter than data blocks, the memory consumed by the queue on a parsing forwarder is likely to be much smaller than on a non-parsing forwarder, if you use this version of the setting.\nIf specified as a lone integer (for example, maxQueueSize=100), maxQueueSize indicates the maximum number of queued events (for parsed data) or blocks of data (for unparsed data). A block of data is approximately 64KB. For non-parsing forwarders, such as universal forwarders, that send unparsed data, maxQueueSize is the maximum number of data blocks.\nIf specified as an integer followed by KB, MB, or GB (for example, maxQueueSize=100MB), maxQueueSize indicates the maximum RAM allocated to the queue buffer. Defaults to 500KB (which means a maximum size of 500KB for the output queue and 1500KB for the wait queue, if any).\n"},"method":{"type":"string","description":"Valid values: (tcpout | syslog). Specifies the type of output processor.\n"},"name":{"type":"string","description":"The name of the group of receivers.\n","willReplaceOnChanges":true},"sendCookedData":{"type":"boolean","description":"If true, events are cooked (processed by Splunk software). If false, events are raw and untouched prior to sending. Defaults to true.\nSet to false if you are sending to a third-party system.\n"},"servers":{"type":"array","items":{"type":"string"},"description":"Comma-separated list of servers to include in the group.\n"},"token":{"type":"string","description":"Token value generated by the indexer after configuration.\n"}},"type":"object"}},"splunk:index/outputsTcpServer:OutputsTcpServer":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.OutputsTcpServer\n\" pulumi-lang-dotnet=\" splunk.OutputsTcpServer\n\" pulumi-lang-go=\" OutputsTcpServer\n\" pulumi-lang-python=\" OutputsTcpServer\n\" pulumi-lang-yaml=\" splunk.OutputsTcpServer\n\" pulumi-lang-java=\" splunk.OutputsTcpServer\n\"\u003e splunk.OutputsTcpServer\n\u003c/span\u003e\nAccess data forwarding configurations.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst tcpServer = new splunk.OutputsTcpServer(\"tcp_server\", {\n    name: \"new-host:1234\",\n    sslAltNameToCheck: \"old-host\",\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\ntcp_server = splunk.OutputsTcpServer(\"tcp_server\",\n    name=\"new-host:1234\",\n    ssl_alt_name_to_check=\"old-host\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var tcpServer = new Splunk.OutputsTcpServer(\"tcp_server\", new()\n    {\n        Name = \"new-host:1234\",\n        SslAltNameToCheck = \"old-host\",\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewOutputsTcpServer(ctx, \"tcp_server\", \u0026splunk.OutputsTcpServerArgs{\n\t\t\tName:              pulumi.String(\"new-host:1234\"),\n\t\t\tSslAltNameToCheck: pulumi.String(\"old-host\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.OutputsTcpServer;\nimport com.pulumi.splunk.OutputsTcpServerArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var tcpServer = new OutputsTcpServer(\"tcpServer\", OutputsTcpServerArgs.builder()\n            .name(\"new-host:1234\")\n            .sslAltNameToCheck(\"old-host\")\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  tcpServer:\n    type: splunk:OutputsTcpServer\n    name: tcp_server\n    properties:\n      name: new-host:1234\n      sslAltNameToCheck: old-host\n```\n\u003c!--End PulumiCodeChooser --\u003e\n","properties":{"acl":{"$ref":"#/types/splunk:index/OutputsTcpServerAcl:OutputsTcpServerAcl","description":"The app/user context that is the namespace for the resource\n"},"disabled":{"type":"boolean","description":"If true, disables the group.\n"},"method":{"type":"string","description":"Valid values: (clone | balance | autobalance)\nThe data distribution method used when two or more servers exist in the same forwarder group.\n"},"name":{"type":"string","description":"\u003chost\u003e:\u003cport\u003e of the Splunk receiver. \u003chost\u003e can be either an ip address or server name. \u003cport\u003e is the that port that the Splunk receiver is listening on.\n"},"sslAltNameToCheck":{"type":"string","description":"The alternate name to match in the remote server's SSL certificate.\n"},"sslCertPath":{"type":"string","description":"Path to the client certificate. If specified, connection uses SSL.\n"},"sslCipher":{"type":"string","description":"SSL Cipher in the form ALL:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM\n"},"sslCommonNameToCheck":{"type":"string","description":"Check the common name of the server's certificate against this name.\nIf there is no match, assume that Splunk Enterprise is not authenticated against this server. You must specify this setting if sslVerifyServerCert is true.\n"},"sslPassword":{"type":"string","description":"The password associated with the CAcert.\nThe default Splunk Enterprise CAcert uses the password \"password.\"\n","secret":true},"sslRootCaPath":{"type":"string","description":"The path to the root certificate authority file.\n"},"sslVerifyServerCert":{"type":"boolean","description":"If true, make sure that the server you are connecting to is a valid one (authenticated). Both the common name and the alternate name of the server are then checked for a match.\n"}},"required":["acl","disabled","method","name","sslAltNameToCheck","sslCertPath","sslCipher","sslCommonNameToCheck","sslPassword","sslRootCaPath","sslVerifyServerCert"],"inputProperties":{"acl":{"$ref":"#/types/splunk:index/OutputsTcpServerAcl:OutputsTcpServerAcl","description":"The app/user context that is the namespace for the resource\n"},"disabled":{"type":"boolean","description":"If true, disables the group.\n"},"method":{"type":"string","description":"Valid values: (clone | balance | autobalance)\nThe data distribution method used when two or more servers exist in the same forwarder group.\n"},"name":{"type":"string","description":"\u003chost\u003e:\u003cport\u003e of the Splunk receiver. \u003chost\u003e can be either an ip address or server name. \u003cport\u003e is the that port that the Splunk receiver is listening on.\n","willReplaceOnChanges":true},"sslAltNameToCheck":{"type":"string","description":"The alternate name to match in the remote server's SSL certificate.\n"},"sslCertPath":{"type":"string","description":"Path to the client certificate. If specified, connection uses SSL.\n"},"sslCipher":{"type":"string","description":"SSL Cipher in the form ALL:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM\n"},"sslCommonNameToCheck":{"type":"string","description":"Check the common name of the server's certificate against this name.\nIf there is no match, assume that Splunk Enterprise is not authenticated against this server. You must specify this setting if sslVerifyServerCert is true.\n"},"sslPassword":{"type":"string","description":"The password associated with the CAcert.\nThe default Splunk Enterprise CAcert uses the password \"password.\"\n","secret":true},"sslRootCaPath":{"type":"string","description":"The path to the root certificate authority file.\n"},"sslVerifyServerCert":{"type":"boolean","description":"If true, make sure that the server you are connecting to is a valid one (authenticated). Both the common name and the alternate name of the server are then checked for a match.\n"}},"stateInputs":{"description":"Input properties used for looking up and filtering OutputsTcpServer resources.\n","properties":{"acl":{"$ref":"#/types/splunk:index/OutputsTcpServerAcl:OutputsTcpServerAcl","description":"The app/user context that is the namespace for the resource\n"},"disabled":{"type":"boolean","description":"If true, disables the group.\n"},"method":{"type":"string","description":"Valid values: (clone | balance | autobalance)\nThe data distribution method used when two or more servers exist in the same forwarder group.\n"},"name":{"type":"string","description":"\u003chost\u003e:\u003cport\u003e of the Splunk receiver. \u003chost\u003e can be either an ip address or server name. \u003cport\u003e is the that port that the Splunk receiver is listening on.\n","willReplaceOnChanges":true},"sslAltNameToCheck":{"type":"string","description":"The alternate name to match in the remote server's SSL certificate.\n"},"sslCertPath":{"type":"string","description":"Path to the client certificate. If specified, connection uses SSL.\n"},"sslCipher":{"type":"string","description":"SSL Cipher in the form ALL:!aNULL:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM\n"},"sslCommonNameToCheck":{"type":"string","description":"Check the common name of the server's certificate against this name.\nIf there is no match, assume that Splunk Enterprise is not authenticated against this server. You must specify this setting if sslVerifyServerCert is true.\n"},"sslPassword":{"type":"string","description":"The password associated with the CAcert.\nThe default Splunk Enterprise CAcert uses the password \"password.\"\n","secret":true},"sslRootCaPath":{"type":"string","description":"The path to the root certificate authority file.\n"},"sslVerifyServerCert":{"type":"boolean","description":"If true, make sure that the server you are connecting to is a valid one (authenticated). Both the common name and the alternate name of the server are then checked for a match.\n"}},"type":"object"}},"splunk:index/outputsTcpSyslog:OutputsTcpSyslog":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.OutputsTcpSyslog\n\" pulumi-lang-dotnet=\" splunk.OutputsTcpSyslog\n\" pulumi-lang-go=\" OutputsTcpSyslog\n\" pulumi-lang-python=\" OutputsTcpSyslog\n\" pulumi-lang-yaml=\" splunk.OutputsTcpSyslog\n\" pulumi-lang-java=\" splunk.OutputsTcpSyslog\n\"\u003e splunk.OutputsTcpSyslog\n\u003c/span\u003e\nAccess the configuration of a forwarded server configured to provide data in standard syslog format.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst tcpSyslog = new splunk.OutputsTcpSyslog(\"tcp_syslog\", {\n    name: \"new-syslog\",\n    server: \"new-host-1:1234\",\n    priority: 5,\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\ntcp_syslog = splunk.OutputsTcpSyslog(\"tcp_syslog\",\n    name=\"new-syslog\",\n    server=\"new-host-1:1234\",\n    priority=5)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var tcpSyslog = new Splunk.OutputsTcpSyslog(\"tcp_syslog\", new()\n    {\n        Name = \"new-syslog\",\n        Server = \"new-host-1:1234\",\n        Priority = 5,\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewOutputsTcpSyslog(ctx, \"tcp_syslog\", \u0026splunk.OutputsTcpSyslogArgs{\n\t\t\tName:     pulumi.String(\"new-syslog\"),\n\t\t\tServer:   pulumi.String(\"new-host-1:1234\"),\n\t\t\tPriority: pulumi.Int(5),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.OutputsTcpSyslog;\nimport com.pulumi.splunk.OutputsTcpSyslogArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var tcpSyslog = new OutputsTcpSyslog(\"tcpSyslog\", OutputsTcpSyslogArgs.builder()\n            .name(\"new-syslog\")\n            .server(\"new-host-1:1234\")\n            .priority(5)\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  tcpSyslog:\n    type: splunk:OutputsTcpSyslog\n    name: tcp_syslog\n    properties:\n      name: new-syslog\n      server: new-host-1:1234\n      priority: 5\n```\n\u003c!--End PulumiCodeChooser --\u003e\n","properties":{"acl":{"$ref":"#/types/splunk:index/OutputsTcpSyslogAcl:OutputsTcpSyslogAcl","description":"The app/user context that is the namespace for the resource\n"},"disabled":{"type":"boolean","description":"If true, disables global syslog settings.\n"},"name":{"type":"string","description":"Name of the syslog output group. This is name used when creating syslog configuration in outputs.conf.\n"},"priority":{"type":"integer","description":"Sets syslog priority value. The priority value should specified as an integer. See $SPLUNK_HOME/etc/system/README/outputs.conf.spec for details.\n"},"server":{"type":"string","description":"host:port of the server where syslog data should be sent\n"},"syslogSourcetype":{"type":"string","description":"Specifies a rule for handling data in addition to that provided by the \"syslog\" sourcetype. By default, there is no value for syslogSourceType.\n\u003cbr\u003eThis string is used as a substring match against the sourcetype key. For example, if the string is set to 'syslog', then all source types containing the string \"syslog\" receives this special treatment.\nTo match a source type explicitly, use the pattern \"sourcetype::sourcetype_name.\" For example\nsyslogSourcetype = sourcetype::apache_common\nData that is \"syslog\" or matches this setting is assumed to already be in syslog format.\nData that does not match the rules has a header, potentially a timestamp, and a hostname added to the front of the event. This is how Splunk software causes arbitrary log data to match syslog expectations.\n"},"timestampFormat":{"type":"string","description":"Format of timestamp to add at start of the events to be forwarded.\nThe format is a strftime-style timestamp formatting string. See $SPLUNK_HOME/etc/system/README/outputs.conf.spec for details.\n"},"type":{"type":"string","description":"Protocol to use to send syslog data. Valid values: (tcp | udp ).\n"}},"required":["acl","disabled","name","priority","server","syslogSourcetype","timestampFormat","type"],"inputProperties":{"acl":{"$ref":"#/types/splunk:index/OutputsTcpSyslogAcl:OutputsTcpSyslogAcl","description":"The app/user context that is the namespace for the resource\n"},"disabled":{"type":"boolean","description":"If true, disables global syslog settings.\n"},"name":{"type":"string","description":"Name of the syslog output group. This is name used when creating syslog configuration in outputs.conf.\n","willReplaceOnChanges":true},"priority":{"type":"integer","description":"Sets syslog priority value. The priority value should specified as an integer. See $SPLUNK_HOME/etc/system/README/outputs.conf.spec for details.\n"},"server":{"type":"string","description":"host:port of the server where syslog data should be sent\n"},"syslogSourcetype":{"type":"string","description":"Specifies a rule for handling data in addition to that provided by the \"syslog\" sourcetype. By default, there is no value for syslogSourceType.\n\u003cbr\u003eThis string is used as a substring match against the sourcetype key. For example, if the string is set to 'syslog', then all source types containing the string \"syslog\" receives this special treatment.\nTo match a source type explicitly, use the pattern \"sourcetype::sourcetype_name.\" For example\nsyslogSourcetype = sourcetype::apache_common\nData that is \"syslog\" or matches this setting is assumed to already be in syslog format.\nData that does not match the rules has a header, potentially a timestamp, and a hostname added to the front of the event. This is how Splunk software causes arbitrary log data to match syslog expectations.\n"},"timestampFormat":{"type":"string","description":"Format of timestamp to add at start of the events to be forwarded.\nThe format is a strftime-style timestamp formatting string. See $SPLUNK_HOME/etc/system/README/outputs.conf.spec for details.\n"},"type":{"type":"string","description":"Protocol to use to send syslog data. Valid values: (tcp | udp ).\n"}},"stateInputs":{"description":"Input properties used for looking up and filtering OutputsTcpSyslog resources.\n","properties":{"acl":{"$ref":"#/types/splunk:index/OutputsTcpSyslogAcl:OutputsTcpSyslogAcl","description":"The app/user context that is the namespace for the resource\n"},"disabled":{"type":"boolean","description":"If true, disables global syslog settings.\n"},"name":{"type":"string","description":"Name of the syslog output group. This is name used when creating syslog configuration in outputs.conf.\n","willReplaceOnChanges":true},"priority":{"type":"integer","description":"Sets syslog priority value. The priority value should specified as an integer. See $SPLUNK_HOME/etc/system/README/outputs.conf.spec for details.\n"},"server":{"type":"string","description":"host:port of the server where syslog data should be sent\n"},"syslogSourcetype":{"type":"string","description":"Specifies a rule for handling data in addition to that provided by the \"syslog\" sourcetype. By default, there is no value for syslogSourceType.\n\u003cbr\u003eThis string is used as a substring match against the sourcetype key. For example, if the string is set to 'syslog', then all source types containing the string \"syslog\" receives this special treatment.\nTo match a source type explicitly, use the pattern \"sourcetype::sourcetype_name.\" For example\nsyslogSourcetype = sourcetype::apache_common\nData that is \"syslog\" or matches this setting is assumed to already be in syslog format.\nData that does not match the rules has a header, potentially a timestamp, and a hostname added to the front of the event. This is how Splunk software causes arbitrary log data to match syslog expectations.\n"},"timestampFormat":{"type":"string","description":"Format of timestamp to add at start of the events to be forwarded.\nThe format is a strftime-style timestamp formatting string. See $SPLUNK_HOME/etc/system/README/outputs.conf.spec for details.\n"},"type":{"type":"string","description":"Protocol to use to send syslog data. Valid values: (tcp | udp ).\n"}},"type":"object"}},"splunk:index/savedSearches:SavedSearches":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.SavedSearches\n\" pulumi-lang-dotnet=\" splunk.SavedSearches\n\" pulumi-lang-go=\" SavedSearches\n\" pulumi-lang-python=\" SavedSearches\n\" pulumi-lang-yaml=\" splunk.SavedSearches\n\" pulumi-lang-java=\" splunk.SavedSearches\n\"\u003e splunk.SavedSearches\n\u003c/span\u003e\nCreate and manage saved searches.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst savedSearch = new splunk.SavedSearches(\"saved_search\", {\n    name: \"Test New Alert\",\n    search: \"index=main\",\n    actions: \"email\",\n    actionEmailFormat: \"table\",\n    actionEmailMaxTime: \"5m\",\n    actionEmailMaxResults: 10,\n    actionEmailSendResults: false,\n    actionEmailSubject: \"Splunk Alert: $name$\",\n    actionEmailTo: \"splunk@splunk.com\",\n    actionEmailTrackAlert: true,\n    dispatchEarliestTime: \"rt-15m\",\n    dispatchLatestTime: \"rt-0m\",\n    cronSchedule: \"*/5 * * * *\",\n    acl: {\n        owner: \"admin\",\n        sharing: \"app\",\n        app: \"launcher\",\n    },\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\nsaved_search = splunk.SavedSearches(\"saved_search\",\n    name=\"Test New Alert\",\n    search=\"index=main\",\n    actions=\"email\",\n    action_email_format=\"table\",\n    action_email_max_time=\"5m\",\n    action_email_max_results=10,\n    action_email_send_results=False,\n    action_email_subject=\"Splunk Alert: $name$\",\n    action_email_to=\"splunk@splunk.com\",\n    action_email_track_alert=True,\n    dispatch_earliest_time=\"rt-15m\",\n    dispatch_latest_time=\"rt-0m\",\n    cron_schedule=\"*/5 * * * *\",\n    acl={\n        \"owner\": \"admin\",\n        \"sharing\": \"app\",\n        \"app\": \"launcher\",\n    })\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var savedSearch = new Splunk.SavedSearches(\"saved_search\", new()\n    {\n        Name = \"Test New Alert\",\n        Search = \"index=main\",\n        Actions = \"email\",\n        ActionEmailFormat = \"table\",\n        ActionEmailMaxTime = \"5m\",\n        ActionEmailMaxResults = 10,\n        ActionEmailSendResults = false,\n        ActionEmailSubject = \"Splunk Alert: $name$\",\n        ActionEmailTo = \"splunk@splunk.com\",\n        ActionEmailTrackAlert = true,\n        DispatchEarliestTime = \"rt-15m\",\n        DispatchLatestTime = \"rt-0m\",\n        CronSchedule = \"*/5 * * * *\",\n        Acl = new Splunk.Inputs.SavedSearchesAclArgs\n        {\n            Owner = \"admin\",\n            Sharing = \"app\",\n            App = \"launcher\",\n        },\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewSavedSearches(ctx, \"saved_search\", \u0026splunk.SavedSearchesArgs{\n\t\t\tName:                   pulumi.String(\"Test New Alert\"),\n\t\t\tSearch:                 pulumi.String(\"index=main\"),\n\t\t\tActions:                pulumi.String(\"email\"),\n\t\t\tActionEmailFormat:      pulumi.String(\"table\"),\n\t\t\tActionEmailMaxTime:     pulumi.String(\"5m\"),\n\t\t\tActionEmailMaxResults:  pulumi.Int(10),\n\t\t\tActionEmailSendResults: pulumi.Bool(false),\n\t\t\tActionEmailSubject:     pulumi.String(\"Splunk Alert: $name$\"),\n\t\t\tActionEmailTo:          pulumi.String(\"splunk@splunk.com\"),\n\t\t\tActionEmailTrackAlert:  pulumi.Bool(true),\n\t\t\tDispatchEarliestTime:   pulumi.String(\"rt-15m\"),\n\t\t\tDispatchLatestTime:     pulumi.String(\"rt-0m\"),\n\t\t\tCronSchedule:           pulumi.String(\"*/5 * * * *\"),\n\t\t\tAcl: \u0026splunk.SavedSearchesAclArgs{\n\t\t\t\tOwner:   pulumi.String(\"admin\"),\n\t\t\t\tSharing: pulumi.String(\"app\"),\n\t\t\t\tApp:     pulumi.String(\"launcher\"),\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.SavedSearches;\nimport com.pulumi.splunk.SavedSearchesArgs;\nimport com.pulumi.splunk.inputs.SavedSearchesAclArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var savedSearch = new SavedSearches(\"savedSearch\", SavedSearchesArgs.builder()\n            .name(\"Test New Alert\")\n            .search(\"index=main\")\n            .actions(\"email\")\n            .actionEmailFormat(\"table\")\n            .actionEmailMaxTime(\"5m\")\n            .actionEmailMaxResults(10)\n            .actionEmailSendResults(false)\n            .actionEmailSubject(\"Splunk Alert: $name$\")\n            .actionEmailTo(\"splunk@splunk.com\")\n            .actionEmailTrackAlert(true)\n            .dispatchEarliestTime(\"rt-15m\")\n            .dispatchLatestTime(\"rt-0m\")\n            .cronSchedule(\"*/5 * * * *\")\n            .acl(SavedSearchesAclArgs.builder()\n                .owner(\"admin\")\n                .sharing(\"app\")\n                .app(\"launcher\")\n                .build())\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  savedSearch:\n    type: splunk:SavedSearches\n    name: saved_search\n    properties:\n      name: Test New Alert\n      search: index=main\n      actions: email\n      actionEmailFormat: table\n      actionEmailMaxTime: 5m\n      actionEmailMaxResults: 10\n      actionEmailSendResults: false\n      actionEmailSubject: 'Splunk Alert: $name$'\n      actionEmailTo: splunk@splunk.com\n      actionEmailTrackAlert: true\n      dispatchEarliestTime: rt-15m\n      dispatchLatestTime: rt-0m\n      cronSchedule: '*/5 * * * *'\n      acl:\n        owner: admin\n        sharing: app\n        app: launcher\n```\n\u003c!--End PulumiCodeChooser --\u003e\n","properties":{"acl":{"$ref":"#/types/splunk:index/SavedSearchesAcl:SavedSearchesAcl","description":"The app/user context that is the namespace for the resource\n"},"actionBetterWebhookParamBodyFormat":{"type":"string","description":"Format of the body content. Valid values are json, xml, form-urlencoded, or raw\n"},"actionBetterWebhookParamCredential":{"type":"string","description":"Name of the Splunk stored credential to use for authentication\n"},"actionBetterWebhookParamCredentials":{"type":"string","description":"Use the credentials defined in the webhook URL\n"},"actionBetterWebhookParamUrl":{"type":"string","description":"URL to send the HTTP POST request to. Must be accessible from the Splunk server\n"},"actionCreateXsoarIncident":{"type":"string","description":"Enable XSOAR alerting (Should by 1 (Enabled) or 0 (Disabled))\n"},"actionCreateXsoarIncidentParamCustomFields":{"type":"string","description":"XSOAR custom incident fields (should be a comma separated list)\n"},"actionCreateXsoarIncidentParamDetails":{"type":"string","description":"XSOAR incident description\n"},"actionCreateXsoarIncidentParamIncidentName":{"type":"string","description":"XSOAR incident name\n"},"actionCreateXsoarIncidentParamOccurred":{"type":"string","description":"XSOAR incident time\n"},"actionCreateXsoarIncidentParamSendAllServers":{"type":"string","description":"Enable XSOAR alerting sending to all servers (Should by 1 (Enabled) or 0 (Disabled)\n"},"actionCreateXsoarIncidentParamServerUrl":{"type":"string","description":"XSOAR Server instance URL (Should start with https:// || http://)\n"},"actionCreateXsoarIncidentParamSeverity":{"type":"string","description":"XSOAR Severity (1 - Low, 2 - Medium, 3 - High, 4 - Critical)\n"},"actionCreateXsoarIncidentParamType":{"type":"string","description":"XSOAR incident type\n"},"actionEmail":{"type":"boolean","description":"The state of the email action. Read-only attribute. Value ignored on POST. Use actions to specify a list of enabled actions. Defaults to 0.\n"},"actionEmailAuthPassword":{"type":"string","description":"The password to use when authenticating with the SMTP server. Normally this value is set when editing the email settings, however you can set a clear text password here and it is encrypted on the next platform restart.Defaults to empty string.\n"},"actionEmailAuthUsername":{"type":"string","description":"The username to use when authenticating with the SMTP server. If this is empty string, no authentication is attempted. Defaults to empty stringNOTE: Your SMTP server might reject unauthenticated emails.\n"},"actionEmailBcc":{"type":"string","description":"BCC email address to use if action.email is enabled.\n"},"actionEmailCc":{"type":"string","description":"CC email address to use if action.email is enabled.\n"},"actionEmailCommand":{"type":"string","description":"The search command (or pipeline) which is responsible for executing the action.Generally the command is a template search pipeline which is realized with values from the saved search. To reference saved search field values wrap them in $, for example to reference the savedsearch name use $name$, to reference the search use $search$.\n"},"actionEmailFormat":{"type":"string","description":"Valid values: (table | plain | html | raw | csv)Specify the format of text in the email. This value also applies to any attachments.\n"},"actionEmailFrom":{"type":"string","description":"Email address from which the email action originates.Defaults to splunk@$LOCALHOST or whatever value is set in alert_actions.conf.\n"},"actionEmailHostname":{"type":"string","description":"Sets the hostname used in the web link (url) sent in email actions.This value accepts two forms:hostname (for example, splunkserver, splunkserver.example.com)\n"},"actionEmailIncludeResultsLink":{"type":"integer","description":"Specify whether to include a link to the results. Defaults to 0.\n"},"actionEmailIncludeSearch":{"type":"integer","description":"Specify whether to include the search that caused an email to be sent. Defaults to 0.\n"},"actionEmailIncludeTrigger":{"type":"integer","description":"Specify whether to show the trigger condition that caused the alert to fire. Defaults to 0.\n"},"actionEmailIncludeTriggerTime":{"type":"integer","description":"Specify whether to show the time that the alert was fired. Defaults to 0.\n"},"actionEmailIncludeViewLink":{"type":"integer","description":"Specify whether to show the title and a link to enable the user to edit the saved search. Defaults to 0.\n"},"actionEmailInline":{"type":"boolean","description":"Indicates whether the search results are contained in the body of the email.Results can be either inline or attached to an email.\n"},"actionEmailMailserver":{"type":"string","description":"Set the address of the MTA server to be used to send the emails.Defaults to \u003cLOCALHOST\u003e or whatever is set in alert_actions.conf.\n"},"actionEmailMaxResults":{"type":"integer","description":"Sets the global maximum number of search results to send when email.action is enabled. Defaults to 100.\n"},"actionEmailMaxTime":{"type":"string","description":"Valid values are Integer[m|s|h|d].Specifies the maximum amount of time the execution of an email action takes before the action is aborted. Defaults to 5m.\n"},"actionEmailMessageAlert":{"type":"string","description":"Customize the message sent in the emailed alert. Defaults to: The alert condition for '$name$' was triggered.\n"},"actionEmailMessageReport":{"type":"string","description":"Customize the message sent in the emailed report. Defaults to: The scheduled report '$name$' has run\n"},"actionEmailPdfview":{"type":"string","description":"The name of the view to deliver if sendpdf is enabled\n"},"actionEmailPreprocessResults":{"type":"string","description":"Search string to preprocess results before emailing them. Defaults to empty string (no preprocessing).Usually the preprocessing consists of filtering out unwanted internal fields.\n"},"actionEmailReportCidFontList":{"type":"string","description":"Space-separated list. Specifies the set (and load order) of CID fonts for handling Simplified Chinese(gb), Traditional Chinese(cns), Japanese(jp), and Korean(kor) in Integrated PDF Rendering.If multiple fonts provide a glyph for a given character code, the glyph from the first font specified in the list is used.To skip loading any CID fonts, specify the empty string.Defaults to 'gb cns jp kor'\n"},"actionEmailReportIncludeSplunkLogo":{"type":"boolean","description":"Indicates whether to include the Splunk logo with the report.\n"},"actionEmailReportPaperOrientation":{"type":"string","description":"Valid values: (portrait | landscape)Specifies the paper orientation: portrait or landscape. Defaults to portrait.\n"},"actionEmailReportPaperSize":{"type":"string","description":"Valid values: (letter | legal | ledger | a2 | a3 | a4 | a5)Specifies the paper size for PDFs. Defaults to letter.\n"},"actionEmailReportServerEnabled":{"type":"boolean","description":"No Supported\n"},"actionEmailReportServerUrl":{"type":"string","description":"Not supported.For a default locally installed report server, the URL is http://localhost:8091/\n"},"actionEmailSendCsv":{"type":"integer","description":"Specify whether to send results as a CSV file. Defaults to 0.\n"},"actionEmailSendPdf":{"type":"boolean","description":"Indicates whether to create and send the results as a PDF. Defaults to false.\n"},"actionEmailSendResults":{"type":"boolean","description":"Indicates whether to attach the search results in the email.Results can be either attached or inline. See action.email.inline.\n"},"actionEmailSubject":{"type":"string","description":"Specifies an alternate email subject.Defaults to SplunkAlert-\u003csavedsearchname\u003e.\n"},"actionEmailTo":{"type":"string","description":"A comma or semicolon separated list of recipient email addresses. Required if this search is scheduled and the email alert action is enabled.\n"},"actionEmailTrackAlert":{"type":"boolean","description":"Indicates whether the execution of this action signifies a trackable alert.\n"},"actionEmailTtl":{"type":"string","description":"Valid values are Integer[p].Specifies the minimum time-to-live in seconds of the search artifacts if this action is triggered. If p follows \u003cInteger\u003e, int is the number of scheduled periods. Defaults to 86400 (24 hours).If no actions are triggered, the artifacts have their ttl determined by dispatch.ttl in savedsearches.conf.\n"},"actionEmailUseSsl":{"type":"boolean","description":"Indicates whether to use SSL when communicating with the SMTP server. Defaults to false.\n"},"actionEmailUseTls":{"type":"boolean","description":"Indicates whether to use TLS (transport layer security) when communicating with the SMTP server (starttls).Defaults to false.\n"},"actionEmailWidthSortColumns":{"type":"boolean","description":"Indicates whether columns should be sorted from least wide to most wide, left to right.Only valid if format=text.\n"},"actionJiraServiceDeskParamAccount":{"type":"string","description":"Jira Service Desk account name\n"},"actionJiraServiceDeskParamJiraCustomfields":{"type":"string","description":"Jira custom fields data (see https://ta-jira-service-desk-simple-addon.readthedocs.io/en/latest/userguide.html)\n"},"actionJiraServiceDeskParamJiraDescription":{"type":"string","description":"Jira issue description\n"},"actionJiraServiceDeskParamJiraIssueType":{"type":"string","description":"Jira issue type name\n"},"actionJiraServiceDeskParamJiraPriority":{"type":"string","description":"Jira priority of issue\n"},"actionJiraServiceDeskParamJiraProject":{"type":"string","description":"Jira Project name\n"},"actionJiraServiceDeskParamJiraSummary":{"type":"string","description":"Jira issue title/summary\n"},"actionLogevent":{"type":"string","description":"Enable log event action (Should be 1 (Enabled) or 0 (Disabled))\n"},"actionLogeventParamEvent":{"type":"string","description":"Specific event text for the logged event.\n"},"actionLogeventParamHost":{"type":"string","description":"Value for the host field of the logged event.\n"},"actionLogeventParamIndex":{"type":"string","description":"Destination index where to store the logged event.\n"},"actionLogeventParamSource":{"type":"string","description":"Value for the source field of the logged event.\n"},"actionLogeventParamSourcetype":{"type":"string","description":"Destination sourcetype where to store the logged event.\n"},"actionPagerdutyCustomDetails":{"type":"string","description":"The PagerDuty custom details information.\n"},"actionPagerdutyIntegrationKey":{"type":"string","description":"The PagerDuty integration Key.\n"},"actionPagerdutyIntegrationKeyOverride":{"type":"string","description":"The PagerDuty integration Key override.\n"},"actionPagerdutyIntegrationUrl":{"type":"string","description":"The pagerduty integration URL. This integration uses Splunk's native webhooks to send events to PagerDuty.\n"},"actionPagerdutyIntegrationUrlOverride":{"type":"string","description":"The pagerduty integration URL override. This integration uses Splunk's native webhooks to send events to PagerDuty.\n"},"actionPopulateLookup":{"type":"boolean","description":"The state of the populate lookup action. Read-only attribute. Value ignored on POST. Use actions to specify a list of enabled actions. Defaults to 0.\n"},"actionPopulateLookupCommand":{"type":"string","description":"The search command (or pipeline) which is responsible for executing the action.\n"},"actionPopulateLookupDest":{"type":"string","description":"Lookup name of path of the lookup to populate\n"},"actionPopulateLookupHostname":{"type":"string","description":"Sets the hostname used in the web link (url) sent in alert actions.This value accepts two forms: hostname (for example, splunkserver, splunkserver.example.com)\\n\\nprotocol://hostname:port (for example, http://splunkserver:8000, https://splunkserver.example.com:443)\n"},"actionPopulateLookupMaxResults":{"type":"integer","description":"Sets the maximum number of search results sent using alerts. Defaults to 100.\n"},"actionPopulateLookupMaxTime":{"type":"integer","description":"Valid values are: Integer[m|s|h|d]Sets the maximum amount of time the execution of an action takes before the action is aborted. Defaults to 5m.\n"},"actionPopulateLookupTrackAlert":{"type":"boolean","description":"Indicates whether the execution of this action signifies a trackable alert.\n"},"actionPopulateLookupTtl":{"type":"string","description":"Valid values are Integer[p]Specifies the minimum time-to-live in seconds of the search artifacts if this action is triggered. If p follows Integer, then this specifies the number of scheduled periods. Defaults to 10p.\n"},"actionRss":{"type":"boolean","description":"The state of the rss action. Read-only attribute. Value ignored on POST.Use actions to specify a list of enabled actions. Defaults to 0.\n"},"actionRssCommand":{"type":"string","description":"The search command (or pipeline) which is responsible for executing the action.Generally the command is a template search pipeline which is realized with values from the saved search. To reference saved search field values wrap them in $, for example to reference the savedsearch name use $name$, to reference the search use $search$.\n"},"actionRssHostname":{"type":"string","description":"Sets the hostname used in the web link (url) sent in alert actions.This value accepts two forms:hostname (for example, splunkserver, splunkserver.example.com)\\n\\nprotocol://hostname:port (for example, http://splunkserver:8000, https://splunkserver.example.com:443)\n"},"actionRssMaxResults":{"type":"integer","description":"Sets the maximum number of search results sent using alerts. Defaults to 100.\n"},"actionRssMaxTime":{"type":"integer","description":"Valid values are Integer[m|s|h|d].Sets the maximum amount of time the execution of an action takes before the action is aborted. Defaults to 1m.\n"},"actionRssTrackAlert":{"type":"boolean","description":"Indicates whether the execution of this action signifies a trackable alert.\n"},"actionRssTtl":{"type":"string","description":"Valid values are: Integer[p] Specifies the minimum time-to-live in seconds of the search artifacts if this action is triggered. If p follows Integer, specifies the number of scheduled periods. Defaults to 86400 (24 hours).\n"},"actionScript":{"type":"boolean","description":"The state of the script action. Read-only attribute. Value ignored on POST. Use actions to specify a list of enabled actions. Defaults to 0.\n"},"actionScriptCommand":{"type":"string","description":"The search command (or pipeline) which is responsible for executing the action.Generally the command is a template search pipeline which is realized with values from the saved search. To reference saved search field values wrap them in $, for example to reference the savedsearch name use $name$, to reference the search use $search$.\n"},"actionScriptFilename":{"type":"string","description":"File name of the script to call. Required if script action is enabled\n"},"actionScriptHostname":{"type":"string","description":"Sets the hostname used in the web link (url) sent in alert actions.This value accepts two forms:hostname (for example, splunkserver, splunkserver.example.com)\\n\\nprotocol://hostname:port (for example, http://splunkserver:8000, https://splunkserver.example.com:443)\n"},"actionScriptMaxResults":{"type":"integer","description":"Sets the maximum number of search results sent using alerts. Defaults to 100.\n"},"actionScriptMaxTime":{"type":"integer","description":"Valid values are Integer[m|s|h|d].Sets the maximum amount of time the execution of an action takes before the action is aborted. Defaults to 1m.\n"},"actionScriptTrackAlert":{"type":"boolean","description":"Indicates whether the execution of this action signifies a trackable alert.\n"},"actionScriptTtl":{"type":"string","description":"Valid values are: Integer[p] Specifies the minimum time-to-live in seconds of the search artifacts if this action is triggered. If p follows Integer, specifies the number of scheduled periods. Defaults to 86400 (24 hours).\n"},"actionSlackAppAlertIntegrationParamAutoJoinChannel":{"type":"string","description":"Automatically join the channel if the bot is not already a member (Should be 1 (Enabled) or 0 (Disabled))\n"},"actionSlackAppAlertIntegrationParamBotUsername":{"type":"string","description":"The bot username that will post the message\n"},"actionSlackAppAlertIntegrationParamChannel":{"type":"string","description":"Slack channel to send the message to (Should start with # or @)\n"},"actionSlackAppAlertIntegrationParamEmoji":{"type":"string","description":"Emoji icon to use as the bot's avatar (Should start and end with :)\n"},"actionSlackAppAlertIntegrationParamMessage":{"type":"string","description":"Enter the chat message to send to the Slack channel. The message can include tokens that insert text based on the results of the\n"},"actionSlackParamAttachment":{"type":"string","description":"Include a message attachment. Valid values are message, none, or alert_link\n"},"actionSlackParamChannel":{"type":"string","description":"Slack channel to send the message to (Should start with # or @)\n"},"actionSlackParamFields":{"type":"string","description":"Show one or more fields from the search results below your Slack message. Comma-separated list of field names. Allows wildcards. eg. index,source\\*\n"},"actionSlackParamMessage":{"type":"string","description":"Enter the chat message to send to the Slack channel. The message can include tokens that insert text based on the results of the search.\n"},"actionSlackParamWebhookUrlOverride":{"type":"string","description":"You can override the Slack webhook URL here if you need to send the alert message to a different Slack team\n"},"actionSnowEventParamAccount":{"type":"string","description":"Account(s) for which the event is/ are to be created across ServiceNow instance(s)."},"actionSnowEventParamAdditionalInfo":{"type":"string","description":"You can pass additional information that might be of use to the user. This field can also be used to supply the URL of your Splunk search head. When you use the snow_event.py alert-triggered script, the Splunk platform uses the URL to create a deep link that allows a ServiceNow user to navigate back to this Splunk platform search. You can find the resulting full URL for navigation from ServiceNow to the Splunk platform search by clicking Splunk Drilldown in the event page in ServiceNow. See an example below. Note that if you create events using the commands snowevent or snoweventstream, you must supply the URL in this field.You can pass the URL of Splunk as url=\u003cvalue\u003e. You can also pass other fields and their values by || separated key-value format. For example, url=\u003cvalue\u003e||k1=v1||k2=v2||...."},"actionSnowEventParamCiIdentifier":{"type":"string","description":"String that represents a configuration item in your network. You can pass value as || separated key-value format. For example, k1=v1||k2=v2."},"actionSnowEventParamCustomFields":{"type":"string","description":"The custom fields which are configured at the ServiceNow Instance. You can pass the custom fields and their values in the || separated format. For example, custom_field1=value1||custom_field2=value2||...custom_fields used must be present in the\u003cspan pulumi-lang-nodejs=\" emEvent \" pulumi-lang-dotnet=\" EmEvent \" pulumi-lang-go=\" emEvent \" pulumi-lang-python=\" em_event \" pulumi-lang-yaml=\" emEvent \" pulumi-lang-java=\" emEvent \"\u003e em_event \u003c/span\u003etable of ServiceNow."},"actionSnowEventParamDescription":{"type":"string","description":"A brief description of the event."},"actionSnowEventParamNode":{"type":"string","description":"The node, formatted to follow your organization's ITIL standards and mapping. If the node value matches a CI with the same host name, the event is automatically assigned to the matching CI."},"actionSnowEventParamResource":{"type":"string","description":"The resource, formatted to follow your organization's ITIL standards and mapping. For example, resource='CPU'."},"actionSnowEventParamSeverity":{"type":"integer","description":"The severity associated with the event. 0 - Clear 1 - Critical 2 - Major 3 - Minor 4 - Warning"},"actionSnowEventParamType":{"type":"string","description":"The type, formatted to follow your organization's ITIL standards and mapping. For example, type='Virtual Machine'."},"actionSummaryIndex":{"type":"boolean","description":"The state of the summary index action. Read-only attribute. Value ignored on POST. Use actions to specify a list of enabled actions. Defaults to 0.\n"},"actionSummaryIndexCommand":{"type":"string","description":"The search command (or pipeline) which is responsible for executing the action.Generally the command is a template search pipeline which is realized with values from the saved search. To reference saved search field values wrap them in $, for example to reference the savedsearch name use $name$, to reference the search use $search$.\n"},"actionSummaryIndexHostname":{"type":"string","description":"Sets the hostname used in the web link (url) sent in summary-index alert actions.This value accepts two forms:hostname (for example, splunkserver, splunkserver.example.com)protocol://hostname:port (for example, http://splunkserver:8000, https://splunkserver.example.com:443)\n"},"actionSummaryIndexInline":{"type":"boolean","description":"Determines whether to execute the summary indexing action as part of the scheduled search.NOTE: This option is considered only if the summary index action is enabled and is always executed (in other words, if counttype = always).Defaults to true\n"},"actionSummaryIndexMaxResults":{"type":"integer","description":"Sets the maximum number of search results sent using alerts. Defaults to 100.\n"},"actionSummaryIndexMaxTime":{"type":"integer","description":"Valid values are Integer[m|s|h|d].Sets the maximum amount of time the execution of an action takes before the action is aborted. Defaults to 1m.\n"},"actionSummaryIndexName":{"type":"string","description":"Specifies the name of the summary index where the results of the scheduled search are saved.Defaults to summary.\n"},"actionSummaryIndexTrackAlert":{"type":"boolean","description":"Indicates whether the execution of this action signifies a trackable alert.\n"},"actionSummaryIndexTtl":{"type":"string","description":"Valid values are: Integer[p] Specifies the minimum time-to-live in seconds of the search artifacts if this action is triggered. If p follows Integer, specifies the number of scheduled periods. Defaults to 86400 (24 hours).\n"},"actionVictoropsParamEnableRecovery":{"type":"string","description":"Enable sending of recovery messages (Should be 1 (Enabled) or 0 (Disabled))\n"},"actionVictoropsParamEntityId":{"type":"string","description":"Unique identifier for the affected system or service\n"},"actionVictoropsParamInactivePolls":{"type":"string","description":"Number of inactive polls before sending a recovery message\n"},"actionVictoropsParamMessageType":{"type":"string","description":"Type of VictorOps message. Valid values are info, warning, critical, recovery, ack\n"},"actionVictoropsParamMonitoringTool":{"type":"string","description":"Name of the monitoring tool sending the alert\n"},"actionVictoropsParamPollInterval":{"type":"string","description":"Polling interval for checking the status of the alert (in minutes)\n"},"actionVictoropsParamRecordId":{"type":"string","description":"Identifier used to correlate related alerts\n"},"actionVictoropsParamRoutingKeyOverride":{"type":"string","description":"You can override the VictorOps routing key here if you need to send the alert message to a different VictorOps team\n"},"actionVictoropsParamStateMessage":{"type":"string","description":"Description of the alert condition\n"},"actionWebhookParamUrl":{"type":"string","description":"URL to send the HTTP POST request to. Must be accessible from the Splunk server\n"},"actions":{"type":"string","description":"A comma-separated list of actions to enable. For example: rss,email\n"},"alertComparator":{"type":"string","description":"One of the following strings: greater than, less than, equal to, rises by, drops by, rises by perc, drops by percUsed with\u003cspan pulumi-lang-nodejs=\" alertThreshold \" pulumi-lang-dotnet=\" AlertThreshold \" pulumi-lang-go=\" alertThreshold \" pulumi-lang-python=\" alert_threshold \" pulumi-lang-yaml=\" alertThreshold \" pulumi-lang-java=\" alertThreshold \"\u003e alert_threshold \u003c/span\u003eto trigger alert actions.\n"},"alertCondition":{"type":"string","description":"Contains a conditional search that is evaluated against the results of the saved search. Defaults to an empty string.\n"},"alertDigestMode":{"type":"boolean","description":"Specifies whether alert actions are applied to the entire result set or on each individual result.Defaults to 1 (true).\n"},"alertExpires":{"type":"string","description":"Valid values: [number][time-unit]Sets the period of time to show the alert in the dashboard. Defaults to 24h.Use [number][time-unit] to specify a time. For example: 60 = 60 seconds, 1m = 1 minute, 1h = 60 minutes = 1 hour.\n"},"alertSeverity":{"type":"integer","description":"Valid values: (1 | 2 | 3 | 4 | 5 | 6) Sets the alert severity level.Valid values are:1 DEBUG 2 INFO 3 WARN 4 ERROR 5 SEVERE 6 FATAL Defaults to 3.\n"},"alertSuppress":{"type":"boolean","description":"Indicates whether alert suppression is enabled for this scheduled search.\n"},"alertSuppressFields":{"type":"string","description":"Comma delimited list of fields to use for suppression when doing per result alerting. Required if suppression is turned on and per result alerting is enabled.\n"},"alertSuppressPeriod":{"type":"string","description":"Valid values: [number][time-unit] Specifies the suppresion period. Only valid if alert.supress is enabled.Use [number][time-unit] to specify a time. For example: 60 = 60 seconds, 1m = 1 minute, 1h = 60 minutes = 1 hour.\n"},"alertThreshold":{"type":"string","description":"Valid values are: Integer[%]Specifies the value to compare (see alert_comparator) before triggering the alert actions. If expressed as a percentage, indicates value to use when\u003cspan pulumi-lang-nodejs=\" alertComparator \" pulumi-lang-dotnet=\" AlertComparator \" pulumi-lang-go=\" alertComparator \" pulumi-lang-python=\" alert_comparator \" pulumi-lang-yaml=\" alertComparator \" pulumi-lang-java=\" alertComparator \"\u003e alert_comparator \u003c/span\u003eis set to rises by perc or drops by perc.\n"},"alertTrack":{"type":"boolean","description":"Valid values: (true | false | auto) Specifies whether to track the actions triggered by this scheduled search.auto - determine whether to track or not based on the tracking setting of each action, do not track scheduled searches that always trigger actions. Default value true - force alert tracking.false - disable alert tracking for this search.\n"},"alertType":{"type":"string","description":"What to base the alert on, overriden by\u003cspan pulumi-lang-nodejs=\" alertCondition \" pulumi-lang-dotnet=\" AlertCondition \" pulumi-lang-go=\" alertCondition \" pulumi-lang-python=\" alert_condition \" pulumi-lang-yaml=\" alertCondition \" pulumi-lang-java=\" alertCondition \"\u003e alert_condition \u003c/span\u003eif it is specified. Valid values are: always, custom, number of events, number of hosts, number of sources.\n"},"allowSkew":{"type":"string","description":"Allows the search scheduler to distribute scheduled searches randomly and more evenly over their specified search periods.\n"},"autoSummarize":{"type":"boolean","description":"Indicates whether the scheduler should ensure that the data for this search is automatically summarized. Defaults to 0.\n"},"autoSummarizeCommand":{"type":"string","description":"An auto summarization template for this search. See auto summarization options in savedsearches.conf for more details.\n"},"autoSummarizeCronSchedule":{"type":"string","description":"Cron schedule that probes and generates the summaries for this saved search.The default value is _/10 _ \\* \\* \\* and corresponds to \\`every ten hours\\`.\n"},"autoSummarizeDispatchEarliestTime":{"type":"string","description":"A time string that specifies the earliest time for summarizing this search. Can be a relative or absolute time.If this value is an absolute time, use the dispatch.time_format to format the value.\n"},"autoSummarizeDispatchLatestTime":{"type":"string","description":"A time string that specifies the latest time for summarizing this saved search. Can be a relative or absolute time.If this value is an absolute time, use the dispatch.time_format to format the value.\n"},"autoSummarizeDispatchTimeFormat":{"type":"string","description":"Defines the time format that Splunk software uses to specify the earliest and latest time. Defaults to %FT%T.%Q%:z\n"},"autoSummarizeDispatchTtl":{"type":"string","description":"Valid values: Integer[p]. Defaults to 60.Indicates the time to live (in seconds) for the artifacts of the summarization of the scheduled search.\n"},"autoSummarizeMaxDisabledBuckets":{"type":"integer","description":"The maximum number of buckets with the suspended summarization before the summarization search is completely stopped, and the summarization of the search is suspended for auto_summarize.suspend_period. Defaults to 2.\n"},"autoSummarizeMaxSummaryRatio":{"type":"number","description":"The maximum ratio of summary_size/bucket_size, which specifies when to stop summarization and deem it unhelpful for a bucket. Defaults to 0.1 Note: The test is only performed if the summary size is larger than auto_summarize.max_summary_size.\n"},"autoSummarizeMaxSummarySize":{"type":"integer","description":"The minimum summary size, in bytes, before testing whether the summarization is helpful.The default value is 52428800 and is equivalent to 5MB.\n"},"autoSummarizeMaxTime":{"type":"integer","description":"Maximum time (in seconds) that the summary search is allowed to run. Defaults to 3600.Note: This is an approximate time. The summary search stops at clean bucket boundaries.\n"},"autoSummarizeSuspendPeriod":{"type":"string","description":"Time specfier indicating when to suspend summarization of this search if the summarization is deemed unhelpful.Defaults to 24h.\n"},"autoSummarizeTimespan":{"type":"string","description":"The list of time ranges that each summarized chunk should span. This comprises the list of available granularity levels for which summaries would be available. Specify a comma delimited list of time specifiers.For example a timechart over the last month whose granuality is at the day level should set this to 1d. If you need the same data summarized at the hour level for weekly charts, use: 1h,1d.\n"},"cronSchedule":{"type":"string","description":"Valid values: cron stringThe cron schedule to execute this search. For example: _/5 _ \\* \\* \\* causes the search to execute every 5 minutes.\n"},"description":{"type":"string","description":"Human-readable description of this saved search. Defaults to empty string.\n"},"disabled":{"type":"boolean","description":"Indicates if the saved search is enabled. Defaults to 0.Disabled saved searches are not visible in Splunk Web.\n"},"dispatchBuckets":{"type":"integer","description":"The maximum number of timeline buckets. Defaults to 0.\n"},"dispatchEarliestTime":{"type":"string","description":"A time string that specifies the earliest time for this search. Can be a relative or absolute time. If this value is an absolute time, use the dispatch.time_format to format the value.\n"},"dispatchIndexEarliest":{"type":"string","description":"A time string that specifies the earliest index time for this search. Can be a relative or absolute time. If this value is an absolute time, use the dispatch.time_format to format the value.\n"},"dispatchIndexLatest":{"type":"string","description":"A time string that specifies the latest index time for this search. Can be a relative or absolute time. If this value is an absolute time, use the dispatch.time_format to format the value.\n"},"dispatchIndexedRealtime":{"type":"boolean","description":"A time string that specifies the earliest time for this search. Can be a relative or absolute time. If this value is an absolute time, use the dispatch.time_format to format the value.\n"},"dispatchIndexedRealtimeMinspan":{"type":"integer","description":"Allows for a per-job override of the [search]\u003cspan pulumi-lang-nodejs=\" indexedRealtimeDiskSyncDelay \" pulumi-lang-dotnet=\" IndexedRealtimeDiskSyncDelay \" pulumi-lang-go=\" indexedRealtimeDiskSyncDelay \" pulumi-lang-python=\" indexed_realtime_disk_sync_delay \" pulumi-lang-yaml=\" indexedRealtimeDiskSyncDelay \" pulumi-lang-java=\" indexedRealtimeDiskSyncDelay \"\u003e indexed_realtime_disk_sync_delay \u003c/span\u003esetting in limits.conf.\n"},"dispatchIndexedRealtimeOffset":{"type":"integer","description":"Allows for a per-job override of the [search]\u003cspan pulumi-lang-nodejs=\" indexedRealtimeDiskSyncDelay \" pulumi-lang-dotnet=\" IndexedRealtimeDiskSyncDelay \" pulumi-lang-go=\" indexedRealtimeDiskSyncDelay \" pulumi-lang-python=\" indexed_realtime_disk_sync_delay \" pulumi-lang-yaml=\" indexedRealtimeDiskSyncDelay \" pulumi-lang-java=\" indexedRealtimeDiskSyncDelay \"\u003e indexed_realtime_disk_sync_delay \u003c/span\u003esetting in limits.conf.\n"},"dispatchLatestTime":{"type":"string","description":"A time string that specifies the latest time for this saved search. Can be a relative or absolute time.If this value is an absolute time, use the dispatch.time_format to format the value.\n"},"dispatchLookups":{"type":"boolean","description":"Enables or disables the lookups for this search. Defaults to 1.\n"},"dispatchMaxCount":{"type":"integer","description":"The maximum number of results before finalizing the search. Defaults to 500000.\n"},"dispatchMaxTime":{"type":"integer","description":"Indicates the maximum amount of time (in seconds) before finalizing the search. Defaults to 0.\n"},"dispatchReduceFreq":{"type":"integer","description":"Specifies, in seconds, how frequently the MapReduce reduce phase runs on accumulated map values. Defaults to 10.\n"},"dispatchRtBackfill":{"type":"boolean","description":"Whether to back fill the real time window for this search. Parameter valid only if this is a real time search. Defaults to 0.\n"},"dispatchRtMaximumSpan":{"type":"integer","description":"Allows for a per-job override of the [search]\u003cspan pulumi-lang-nodejs=\" indexedRealtimeMaximumSpan \" pulumi-lang-dotnet=\" IndexedRealtimeMaximumSpan \" pulumi-lang-go=\" indexedRealtimeMaximumSpan \" pulumi-lang-python=\" indexed_realtime_maximum_span \" pulumi-lang-yaml=\" indexedRealtimeMaximumSpan \" pulumi-lang-java=\" indexedRealtimeMaximumSpan \"\u003e indexed_realtime_maximum_span \u003c/span\u003esetting in limits.conf.\n"},"dispatchSpawnProcess":{"type":"boolean","description":"Specifies whether a new search process spawns when this saved search is executed. Defaults to 1. Searches against indexes must run in a separate process.\n"},"dispatchTimeFormat":{"type":"string","description":"A time format string that defines the time format for specifying the earliest and latest time. Defaults to %FT%T.%Q%:z\n"},"dispatchTtl":{"type":"string","description":"Valid values: Integer[p]. Defaults to 2p.Indicates the time to live (in seconds) for the artifacts of the scheduled search, if no actions are triggered.\n"},"displayView":{"type":"string","description":"Defines the default UI view name (not label) in which to load the results. Accessibility is subject to the user having sufficient permissions.\n"},"isScheduled":{"type":"boolean","description":"Whether this search is to be run on a schedule\n"},"isVisible":{"type":"boolean","description":"Specifies whether this saved search should be listed in the visible saved search list. Defaults to 1.\n"},"maxConcurrent":{"type":"integer","description":"The maximum number of concurrent instances of this search the scheduler is allowed to run. Defaults to 1.\n"},"name":{"type":"string","description":"A name for the search.\n"},"realtimeSchedule":{"type":"boolean","description":"Defaults to 1. Controls the way the scheduler computes the next execution time of a scheduled search. If this value is set to 1, the scheduler bases its determination of the next scheduled search execution time on the current time. If this value is set to 0, the scheduler bases its determination of the next scheduled search on the last search execution time. This is called continuous scheduling. If set to 0, the scheduler never skips scheduled execution periods. However, the execution of the saved search might fall behind depending on the scheduler load. Use continuous scheduling whenever you enable the summary index option.\n"},"requestUiDispatchApp":{"type":"string","description":"Specifies a field used by Splunk Web to denote the app this search should be dispatched in.\n"},"requestUiDispatchView":{"type":"string","description":"Specifies a field used by Splunk Web to denote the view this search should be displayed in.\n"},"restartOnSearchpeerAdd":{"type":"boolean","description":"Specifies whether to restart a real-time search managed by the scheduler when a search peer becomes available for this saved search. Defaults to 1.\n"},"runOnStartup":{"type":"boolean","description":"Indicates whether this search runs at startup. If it does not run on startup, it runs at the next scheduled time. Defaults to 0. Set to 1 for scheduled searches that populate lookup tables.\n"},"schedulePriority":{"type":"string","description":"Raises the scheduling priority of the named search. Defaults to Default\n"},"scheduleWindow":{"type":"string","description":"Time window (in minutes) during which the search has lower priority. Defaults to 0. The scheduler can give higher priority to more critical searches during this window. The window must be smaller than the search period.Set to auto to let the scheduler determine the optimal window value automatically. Requires the\u003cspan pulumi-lang-nodejs=\" editSearchScheduleWindow \" pulumi-lang-dotnet=\" EditSearchScheduleWindow \" pulumi-lang-go=\" editSearchScheduleWindow \" pulumi-lang-python=\" edit_search_schedule_window \" pulumi-lang-yaml=\" editSearchScheduleWindow \" pulumi-lang-java=\" editSearchScheduleWindow \"\u003e edit_search_schedule_window \u003c/span\u003ecapability to override auto.\n"},"search":{"type":"string","description":"Required when creating a new search.\n"},"vsid":{"type":"string","description":"Defines the viewstate id associated with the UI view listed in 'displayview'.\n"},"workloadPool":{"type":"string","description":"Specifies the new workload pool where the existing running search will be placed.`\n"}},"required":["acl","actionEmail","actionEmailAuthPassword","actionEmailAuthUsername","actionEmailBcc","actionEmailCc","actionEmailCommand","actionEmailFormat","actionEmailFrom","actionEmailHostname","actionEmailIncludeResultsLink","actionEmailIncludeSearch","actionEmailIncludeTrigger","actionEmailIncludeTriggerTime","actionEmailIncludeViewLink","actionEmailInline","actionEmailMailserver","actionEmailMaxResults","actionEmailMaxTime","actionEmailMessageAlert","actionEmailMessageReport","actionEmailPdfview","actionEmailPreprocessResults","actionEmailReportCidFontList","actionEmailReportIncludeSplunkLogo","actionEmailReportPaperOrientation","actionEmailReportPaperSize","actionEmailReportServerEnabled","actionEmailReportServerUrl","actionEmailSendCsv","actionEmailSendPdf","actionEmailSendResults","actionEmailSubject","actionEmailTo","actionEmailTrackAlert","actionEmailTtl","actionEmailUseSsl","actionEmailUseTls","actionEmailWidthSortColumns","actionLogevent","actionLogeventParamEvent","actionLogeventParamHost","actionLogeventParamIndex","actionLogeventParamSource","actionLogeventParamSourcetype","actionPagerdutyCustomDetails","actionPagerdutyIntegrationKey","actionPagerdutyIntegrationKeyOverride","actionPopulateLookup","actionPopulateLookupCommand","actionPopulateLookupDest","actionPopulateLookupHostname","actionPopulateLookupMaxResults","actionPopulateLookupMaxTime","actionPopulateLookupTrackAlert","actionPopulateLookupTtl","actionRss","actionRssCommand","actionRssHostname","actionRssMaxResults","actionRssMaxTime","actionRssTrackAlert","actionRssTtl","actionScript","actionScriptCommand","actionScriptFilename","actionScriptHostname","actionScriptMaxResults","actionScriptMaxTime","actionScriptTrackAlert","actionScriptTtl","actionSnowEventParamAccount","actionSnowEventParamAdditionalInfo","actionSnowEventParamCiIdentifier","actionSnowEventParamCustomFields","actionSnowEventParamDescription","actionSnowEventParamNode","actionSnowEventParamResource","actionSnowEventParamSeverity","actionSnowEventParamType","actionSummaryIndex","actionSummaryIndexCommand","actionSummaryIndexHostname","actionSummaryIndexInline","actionSummaryIndexMaxResults","actionSummaryIndexMaxTime","actionSummaryIndexName","actionSummaryIndexTrackAlert","actionSummaryIndexTtl","actions","alertComparator","alertCondition","alertDigestMode","alertExpires","alertSeverity","alertSuppress","alertSuppressFields","alertSuppressPeriod","alertThreshold","alertTrack","alertType","allowSkew","autoSummarize","autoSummarizeCommand","autoSummarizeCronSchedule","autoSummarizeDispatchEarliestTime","autoSummarizeDispatchLatestTime","autoSummarizeDispatchTimeFormat","autoSummarizeDispatchTtl","autoSummarizeMaxDisabledBuckets","autoSummarizeMaxSummaryRatio","autoSummarizeMaxSummarySize","autoSummarizeMaxTime","autoSummarizeSuspendPeriod","autoSummarizeTimespan","cronSchedule","description","disabled","dispatchBuckets","dispatchEarliestTime","dispatchIndexEarliest","dispatchIndexLatest","dispatchIndexedRealtime","dispatchIndexedRealtimeMinspan","dispatchIndexedRealtimeOffset","dispatchLatestTime","dispatchLookups","dispatchMaxCount","dispatchMaxTime","dispatchReduceFreq","dispatchRtBackfill","dispatchRtMaximumSpan","dispatchSpawnProcess","dispatchTimeFormat","dispatchTtl","displayView","isScheduled","maxConcurrent","name","realtimeSchedule","requestUiDispatchApp","requestUiDispatchView","restartOnSearchpeerAdd","runOnStartup","schedulePriority","scheduleWindow","search","vsid","workloadPool"],"inputProperties":{"acl":{"$ref":"#/types/splunk:index/SavedSearchesAcl:SavedSearchesAcl","description":"The app/user context that is the namespace for the resource\n"},"actionBetterWebhookParamBodyFormat":{"type":"string","description":"Format of the body content. Valid values are json, xml, form-urlencoded, or raw\n"},"actionBetterWebhookParamCredential":{"type":"string","description":"Name of the Splunk stored credential to use for authentication\n"},"actionBetterWebhookParamCredentials":{"type":"string","description":"Use the credentials defined in the webhook URL\n"},"actionBetterWebhookParamUrl":{"type":"string","description":"URL to send the HTTP POST request to. Must be accessible from the Splunk server\n"},"actionCreateXsoarIncident":{"type":"string","description":"Enable XSOAR alerting (Should by 1 (Enabled) or 0 (Disabled))\n"},"actionCreateXsoarIncidentParamCustomFields":{"type":"string","description":"XSOAR custom incident fields (should be a comma separated list)\n"},"actionCreateXsoarIncidentParamDetails":{"type":"string","description":"XSOAR incident description\n"},"actionCreateXsoarIncidentParamIncidentName":{"type":"string","description":"XSOAR incident name\n"},"actionCreateXsoarIncidentParamOccurred":{"type":"string","description":"XSOAR incident time\n"},"actionCreateXsoarIncidentParamSendAllServers":{"type":"string","description":"Enable XSOAR alerting sending to all servers (Should by 1 (Enabled) or 0 (Disabled)\n"},"actionCreateXsoarIncidentParamServerUrl":{"type":"string","description":"XSOAR Server instance URL (Should start with https:// || http://)\n"},"actionCreateXsoarIncidentParamSeverity":{"type":"string","description":"XSOAR Severity (1 - Low, 2 - Medium, 3 - High, 4 - Critical)\n"},"actionCreateXsoarIncidentParamType":{"type":"string","description":"XSOAR incident type\n"},"actionEmailAuthPassword":{"type":"string","description":"The password to use when authenticating with the SMTP server. Normally this value is set when editing the email settings, however you can set a clear text password here and it is encrypted on the next platform restart.Defaults to empty string.\n"},"actionEmailAuthUsername":{"type":"string","description":"The username to use when authenticating with the SMTP server. If this is empty string, no authentication is attempted. Defaults to empty stringNOTE: Your SMTP server might reject unauthenticated emails.\n"},"actionEmailBcc":{"type":"string","description":"BCC email address to use if action.email is enabled.\n"},"actionEmailCc":{"type":"string","description":"CC email address to use if action.email is enabled.\n"},"actionEmailCommand":{"type":"string","description":"The search command (or pipeline) which is responsible for executing the action.Generally the command is a template search pipeline which is realized with values from the saved search. To reference saved search field values wrap them in $, for example to reference the savedsearch name use $name$, to reference the search use $search$.\n"},"actionEmailFormat":{"type":"string","description":"Valid values: (table | plain | html | raw | csv)Specify the format of text in the email. This value also applies to any attachments.\n"},"actionEmailFrom":{"type":"string","description":"Email address from which the email action originates.Defaults to splunk@$LOCALHOST or whatever value is set in alert_actions.conf.\n"},"actionEmailHostname":{"type":"string","description":"Sets the hostname used in the web link (url) sent in email actions.This value accepts two forms:hostname (for example, splunkserver, splunkserver.example.com)\n"},"actionEmailIncludeResultsLink":{"type":"integer","description":"Specify whether to include a link to the results. Defaults to 0.\n"},"actionEmailIncludeSearch":{"type":"integer","description":"Specify whether to include the search that caused an email to be sent. Defaults to 0.\n"},"actionEmailIncludeTrigger":{"type":"integer","description":"Specify whether to show the trigger condition that caused the alert to fire. Defaults to 0.\n"},"actionEmailIncludeTriggerTime":{"type":"integer","description":"Specify whether to show the time that the alert was fired. Defaults to 0.\n"},"actionEmailIncludeViewLink":{"type":"integer","description":"Specify whether to show the title and a link to enable the user to edit the saved search. Defaults to 0.\n"},"actionEmailInline":{"type":"boolean","description":"Indicates whether the search results are contained in the body of the email.Results can be either inline or attached to an email.\n"},"actionEmailMailserver":{"type":"string","description":"Set the address of the MTA server to be used to send the emails.Defaults to \u003cLOCALHOST\u003e or whatever is set in alert_actions.conf.\n"},"actionEmailMaxResults":{"type":"integer","description":"Sets the global maximum number of search results to send when email.action is enabled. Defaults to 100.\n"},"actionEmailMaxTime":{"type":"string","description":"Valid values are Integer[m|s|h|d].Specifies the maximum amount of time the execution of an email action takes before the action is aborted. Defaults to 5m.\n"},"actionEmailMessageAlert":{"type":"string","description":"Customize the message sent in the emailed alert. Defaults to: The alert condition for '$name$' was triggered.\n"},"actionEmailMessageReport":{"type":"string","description":"Customize the message sent in the emailed report. Defaults to: The scheduled report '$name$' has run\n"},"actionEmailPdfview":{"type":"string","description":"The name of the view to deliver if sendpdf is enabled\n"},"actionEmailPreprocessResults":{"type":"string","description":"Search string to preprocess results before emailing them. Defaults to empty string (no preprocessing).Usually the preprocessing consists of filtering out unwanted internal fields.\n"},"actionEmailReportCidFontList":{"type":"string","description":"Space-separated list. Specifies the set (and load order) of CID fonts for handling Simplified Chinese(gb), Traditional Chinese(cns), Japanese(jp), and Korean(kor) in Integrated PDF Rendering.If multiple fonts provide a glyph for a given character code, the glyph from the first font specified in the list is used.To skip loading any CID fonts, specify the empty string.Defaults to 'gb cns jp kor'\n"},"actionEmailReportIncludeSplunkLogo":{"type":"boolean","description":"Indicates whether to include the Splunk logo with the report.\n"},"actionEmailReportPaperOrientation":{"type":"string","description":"Valid values: (portrait | landscape)Specifies the paper orientation: portrait or landscape. Defaults to portrait.\n"},"actionEmailReportPaperSize":{"type":"string","description":"Valid values: (letter | legal | ledger | a2 | a3 | a4 | a5)Specifies the paper size for PDFs. Defaults to letter.\n"},"actionEmailReportServerEnabled":{"type":"boolean","description":"No Supported\n"},"actionEmailReportServerUrl":{"type":"string","description":"Not supported.For a default locally installed report server, the URL is http://localhost:8091/\n"},"actionEmailSendCsv":{"type":"integer","description":"Specify whether to send results as a CSV file. Defaults to 0.\n"},"actionEmailSendPdf":{"type":"boolean","description":"Indicates whether to create and send the results as a PDF. Defaults to false.\n"},"actionEmailSendResults":{"type":"boolean","description":"Indicates whether to attach the search results in the email.Results can be either attached or inline. See action.email.inline.\n"},"actionEmailSubject":{"type":"string","description":"Specifies an alternate email subject.Defaults to SplunkAlert-\u003csavedsearchname\u003e.\n"},"actionEmailTo":{"type":"string","description":"A comma or semicolon separated list of recipient email addresses. Required if this search is scheduled and the email alert action is enabled.\n"},"actionEmailTrackAlert":{"type":"boolean","description":"Indicates whether the execution of this action signifies a trackable alert.\n"},"actionEmailTtl":{"type":"string","description":"Valid values are Integer[p].Specifies the minimum time-to-live in seconds of the search artifacts if this action is triggered. If p follows \u003cInteger\u003e, int is the number of scheduled periods. Defaults to 86400 (24 hours).If no actions are triggered, the artifacts have their ttl determined by dispatch.ttl in savedsearches.conf.\n"},"actionEmailUseSsl":{"type":"boolean","description":"Indicates whether to use SSL when communicating with the SMTP server. Defaults to false.\n"},"actionEmailUseTls":{"type":"boolean","description":"Indicates whether to use TLS (transport layer security) when communicating with the SMTP server (starttls).Defaults to false.\n"},"actionEmailWidthSortColumns":{"type":"boolean","description":"Indicates whether columns should be sorted from least wide to most wide, left to right.Only valid if format=text.\n"},"actionJiraServiceDeskParamAccount":{"type":"string","description":"Jira Service Desk account name\n"},"actionJiraServiceDeskParamJiraCustomfields":{"type":"string","description":"Jira custom fields data (see https://ta-jira-service-desk-simple-addon.readthedocs.io/en/latest/userguide.html)\n"},"actionJiraServiceDeskParamJiraDescription":{"type":"string","description":"Jira issue description\n"},"actionJiraServiceDeskParamJiraIssueType":{"type":"string","description":"Jira issue type name\n"},"actionJiraServiceDeskParamJiraPriority":{"type":"string","description":"Jira priority of issue\n"},"actionJiraServiceDeskParamJiraProject":{"type":"string","description":"Jira Project name\n"},"actionJiraServiceDeskParamJiraSummary":{"type":"string","description":"Jira issue title/summary\n"},"actionLogevent":{"type":"string","description":"Enable log event action (Should be 1 (Enabled) or 0 (Disabled))\n"},"actionLogeventParamEvent":{"type":"string","description":"Specific event text for the logged event.\n"},"actionLogeventParamHost":{"type":"string","description":"Value for the host field of the logged event.\n"},"actionLogeventParamIndex":{"type":"string","description":"Destination index where to store the logged event.\n"},"actionLogeventParamSource":{"type":"string","description":"Value for the source field of the logged event.\n"},"actionLogeventParamSourcetype":{"type":"string","description":"Destination sourcetype where to store the logged event.\n"},"actionPagerdutyCustomDetails":{"type":"string","description":"The PagerDuty custom details information.\n"},"actionPagerdutyIntegrationKey":{"type":"string","description":"The PagerDuty integration Key.\n"},"actionPagerdutyIntegrationKeyOverride":{"type":"string","description":"The PagerDuty integration Key override.\n"},"actionPagerdutyIntegrationUrl":{"type":"string","description":"The pagerduty integration URL. This integration uses Splunk's native webhooks to send events to PagerDuty.\n"},"actionPagerdutyIntegrationUrlOverride":{"type":"string","description":"The pagerduty integration URL override. This integration uses Splunk's native webhooks to send events to PagerDuty.\n"},"actionPopulateLookupCommand":{"type":"string","description":"The search command (or pipeline) which is responsible for executing the action.\n"},"actionPopulateLookupDest":{"type":"string","description":"Lookup name of path of the lookup to populate\n"},"actionPopulateLookupHostname":{"type":"string","description":"Sets the hostname used in the web link (url) sent in alert actions.This value accepts two forms: hostname (for example, splunkserver, splunkserver.example.com)\\n\\nprotocol://hostname:port (for example, http://splunkserver:8000, https://splunkserver.example.com:443)\n"},"actionPopulateLookupMaxResults":{"type":"integer","description":"Sets the maximum number of search results sent using alerts. Defaults to 100.\n"},"actionPopulateLookupMaxTime":{"type":"integer","description":"Valid values are: Integer[m|s|h|d]Sets the maximum amount of time the execution of an action takes before the action is aborted. Defaults to 5m.\n"},"actionPopulateLookupTrackAlert":{"type":"boolean","description":"Indicates whether the execution of this action signifies a trackable alert.\n"},"actionPopulateLookupTtl":{"type":"string","description":"Valid values are Integer[p]Specifies the minimum time-to-live in seconds of the search artifacts if this action is triggered. If p follows Integer, then this specifies the number of scheduled periods. Defaults to 10p.\n"},"actionRssCommand":{"type":"string","description":"The search command (or pipeline) which is responsible for executing the action.Generally the command is a template search pipeline which is realized with values from the saved search. To reference saved search field values wrap them in $, for example to reference the savedsearch name use $name$, to reference the search use $search$.\n"},"actionRssHostname":{"type":"string","description":"Sets the hostname used in the web link (url) sent in alert actions.This value accepts two forms:hostname (for example, splunkserver, splunkserver.example.com)\\n\\nprotocol://hostname:port (for example, http://splunkserver:8000, https://splunkserver.example.com:443)\n"},"actionRssMaxResults":{"type":"integer","description":"Sets the maximum number of search results sent using alerts. Defaults to 100.\n"},"actionRssMaxTime":{"type":"integer","description":"Valid values are Integer[m|s|h|d].Sets the maximum amount of time the execution of an action takes before the action is aborted. Defaults to 1m.\n"},"actionRssTrackAlert":{"type":"boolean","description":"Indicates whether the execution of this action signifies a trackable alert.\n"},"actionRssTtl":{"type":"string","description":"Valid values are: Integer[p] Specifies the minimum time-to-live in seconds of the search artifacts if this action is triggered. If p follows Integer, specifies the number of scheduled periods. Defaults to 86400 (24 hours).\n"},"actionScriptCommand":{"type":"string","description":"The search command (or pipeline) which is responsible for executing the action.Generally the command is a template search pipeline which is realized with values from the saved search. To reference saved search field values wrap them in $, for example to reference the savedsearch name use $name$, to reference the search use $search$.\n"},"actionScriptFilename":{"type":"string","description":"File name of the script to call. Required if script action is enabled\n"},"actionScriptHostname":{"type":"string","description":"Sets the hostname used in the web link (url) sent in alert actions.This value accepts two forms:hostname (for example, splunkserver, splunkserver.example.com)\\n\\nprotocol://hostname:port (for example, http://splunkserver:8000, https://splunkserver.example.com:443)\n"},"actionScriptMaxResults":{"type":"integer","description":"Sets the maximum number of search results sent using alerts. Defaults to 100.\n"},"actionScriptMaxTime":{"type":"integer","description":"Valid values are Integer[m|s|h|d].Sets the maximum amount of time the execution of an action takes before the action is aborted. Defaults to 1m.\n"},"actionScriptTrackAlert":{"type":"boolean","description":"Indicates whether the execution of this action signifies a trackable alert.\n"},"actionScriptTtl":{"type":"string","description":"Valid values are: Integer[p] Specifies the minimum time-to-live in seconds of the search artifacts if this action is triggered. If p follows Integer, specifies the number of scheduled periods. Defaults to 86400 (24 hours).\n"},"actionSlackAppAlertIntegrationParamAutoJoinChannel":{"type":"string","description":"Automatically join the channel if the bot is not already a member (Should be 1 (Enabled) or 0 (Disabled))\n"},"actionSlackAppAlertIntegrationParamBotUsername":{"type":"string","description":"The bot username that will post the message\n"},"actionSlackAppAlertIntegrationParamChannel":{"type":"string","description":"Slack channel to send the message to (Should start with # or @)\n"},"actionSlackAppAlertIntegrationParamEmoji":{"type":"string","description":"Emoji icon to use as the bot's avatar (Should start and end with :)\n"},"actionSlackAppAlertIntegrationParamMessage":{"type":"string","description":"Enter the chat message to send to the Slack channel. The message can include tokens that insert text based on the results of the\n"},"actionSlackParamAttachment":{"type":"string","description":"Include a message attachment. Valid values are message, none, or alert_link\n"},"actionSlackParamChannel":{"type":"string","description":"Slack channel to send the message to (Should start with # or @)\n"},"actionSlackParamFields":{"type":"string","description":"Show one or more fields from the search results below your Slack message. Comma-separated list of field names. Allows wildcards. eg. index,source\\*\n"},"actionSlackParamMessage":{"type":"string","description":"Enter the chat message to send to the Slack channel. The message can include tokens that insert text based on the results of the search.\n"},"actionSlackParamWebhookUrlOverride":{"type":"string","description":"You can override the Slack webhook URL here if you need to send the alert message to a different Slack team\n"},"actionSnowEventParamAccount":{"type":"string","description":"Account(s) for which the event is/ are to be created across ServiceNow instance(s)."},"actionSnowEventParamAdditionalInfo":{"type":"string","description":"You can pass additional information that might be of use to the user. This field can also be used to supply the URL of your Splunk search head. When you use the snow_event.py alert-triggered script, the Splunk platform uses the URL to create a deep link that allows a ServiceNow user to navigate back to this Splunk platform search. You can find the resulting full URL for navigation from ServiceNow to the Splunk platform search by clicking Splunk Drilldown in the event page in ServiceNow. See an example below. Note that if you create events using the commands snowevent or snoweventstream, you must supply the URL in this field.You can pass the URL of Splunk as url=\u003cvalue\u003e. You can also pass other fields and their values by || separated key-value format. For example, url=\u003cvalue\u003e||k1=v1||k2=v2||...."},"actionSnowEventParamCiIdentifier":{"type":"string","description":"String that represents a configuration item in your network. You can pass value as || separated key-value format. For example, k1=v1||k2=v2."},"actionSnowEventParamCustomFields":{"type":"string","description":"The custom fields which are configured at the ServiceNow Instance. You can pass the custom fields and their values in the || separated format. For example, custom_field1=value1||custom_field2=value2||...custom_fields used must be present in the\u003cspan pulumi-lang-nodejs=\" emEvent \" pulumi-lang-dotnet=\" EmEvent \" pulumi-lang-go=\" emEvent \" pulumi-lang-python=\" em_event \" pulumi-lang-yaml=\" emEvent \" pulumi-lang-java=\" emEvent \"\u003e em_event \u003c/span\u003etable of ServiceNow."},"actionSnowEventParamDescription":{"type":"string","description":"A brief description of the event."},"actionSnowEventParamNode":{"type":"string","description":"The node, formatted to follow your organization's ITIL standards and mapping. If the node value matches a CI with the same host name, the event is automatically assigned to the matching CI."},"actionSnowEventParamResource":{"type":"string","description":"The resource, formatted to follow your organization's ITIL standards and mapping. For example, resource='CPU'."},"actionSnowEventParamSeverity":{"type":"integer","description":"The severity associated with the event. 0 - Clear 1 - Critical 2 - Major 3 - Minor 4 - Warning"},"actionSnowEventParamType":{"type":"string","description":"The type, formatted to follow your organization's ITIL standards and mapping. For example, type='Virtual Machine'."},"actionSummaryIndexCommand":{"type":"string","description":"The search command (or pipeline) which is responsible for executing the action.Generally the command is a template search pipeline which is realized with values from the saved search. To reference saved search field values wrap them in $, for example to reference the savedsearch name use $name$, to reference the search use $search$.\n"},"actionSummaryIndexHostname":{"type":"string","description":"Sets the hostname used in the web link (url) sent in summary-index alert actions.This value accepts two forms:hostname (for example, splunkserver, splunkserver.example.com)protocol://hostname:port (for example, http://splunkserver:8000, https://splunkserver.example.com:443)\n"},"actionSummaryIndexInline":{"type":"boolean","description":"Determines whether to execute the summary indexing action as part of the scheduled search.NOTE: This option is considered only if the summary index action is enabled and is always executed (in other words, if counttype = always).Defaults to true\n"},"actionSummaryIndexMaxResults":{"type":"integer","description":"Sets the maximum number of search results sent using alerts. Defaults to 100.\n"},"actionSummaryIndexMaxTime":{"type":"integer","description":"Valid values are Integer[m|s|h|d].Sets the maximum amount of time the execution of an action takes before the action is aborted. Defaults to 1m.\n"},"actionSummaryIndexName":{"type":"string","description":"Specifies the name of the summary index where the results of the scheduled search are saved.Defaults to summary.\n"},"actionSummaryIndexTrackAlert":{"type":"boolean","description":"Indicates whether the execution of this action signifies a trackable alert.\n"},"actionSummaryIndexTtl":{"type":"string","description":"Valid values are: Integer[p] Specifies the minimum time-to-live in seconds of the search artifacts if this action is triggered. If p follows Integer, specifies the number of scheduled periods. Defaults to 86400 (24 hours).\n"},"actionVictoropsParamEnableRecovery":{"type":"string","description":"Enable sending of recovery messages (Should be 1 (Enabled) or 0 (Disabled))\n"},"actionVictoropsParamEntityId":{"type":"string","description":"Unique identifier for the affected system or service\n"},"actionVictoropsParamInactivePolls":{"type":"string","description":"Number of inactive polls before sending a recovery message\n"},"actionVictoropsParamMessageType":{"type":"string","description":"Type of VictorOps message. Valid values are info, warning, critical, recovery, ack\n"},"actionVictoropsParamMonitoringTool":{"type":"string","description":"Name of the monitoring tool sending the alert\n"},"actionVictoropsParamPollInterval":{"type":"string","description":"Polling interval for checking the status of the alert (in minutes)\n"},"actionVictoropsParamRecordId":{"type":"string","description":"Identifier used to correlate related alerts\n"},"actionVictoropsParamRoutingKeyOverride":{"type":"string","description":"You can override the VictorOps routing key here if you need to send the alert message to a different VictorOps team\n"},"actionVictoropsParamStateMessage":{"type":"string","description":"Description of the alert condition\n"},"actionWebhookParamUrl":{"type":"string","description":"URL to send the HTTP POST request to. Must be accessible from the Splunk server\n"},"actions":{"type":"string","description":"A comma-separated list of actions to enable. For example: rss,email\n"},"alertComparator":{"type":"string","description":"One of the following strings: greater than, less than, equal to, rises by, drops by, rises by perc, drops by percUsed with\u003cspan pulumi-lang-nodejs=\" alertThreshold \" pulumi-lang-dotnet=\" AlertThreshold \" pulumi-lang-go=\" alertThreshold \" pulumi-lang-python=\" alert_threshold \" pulumi-lang-yaml=\" alertThreshold \" pulumi-lang-java=\" alertThreshold \"\u003e alert_threshold \u003c/span\u003eto trigger alert actions.\n"},"alertCondition":{"type":"string","description":"Contains a conditional search that is evaluated against the results of the saved search. Defaults to an empty string.\n"},"alertDigestMode":{"type":"boolean","description":"Specifies whether alert actions are applied to the entire result set or on each individual result.Defaults to 1 (true).\n"},"alertExpires":{"type":"string","description":"Valid values: [number][time-unit]Sets the period of time to show the alert in the dashboard. Defaults to 24h.Use [number][time-unit] to specify a time. For example: 60 = 60 seconds, 1m = 1 minute, 1h = 60 minutes = 1 hour.\n"},"alertSeverity":{"type":"integer","description":"Valid values: (1 | 2 | 3 | 4 | 5 | 6) Sets the alert severity level.Valid values are:1 DEBUG 2 INFO 3 WARN 4 ERROR 5 SEVERE 6 FATAL Defaults to 3.\n"},"alertSuppress":{"type":"boolean","description":"Indicates whether alert suppression is enabled for this scheduled search.\n"},"alertSuppressFields":{"type":"string","description":"Comma delimited list of fields to use for suppression when doing per result alerting. Required if suppression is turned on and per result alerting is enabled.\n"},"alertSuppressPeriod":{"type":"string","description":"Valid values: [number][time-unit] Specifies the suppresion period. Only valid if alert.supress is enabled.Use [number][time-unit] to specify a time. For example: 60 = 60 seconds, 1m = 1 minute, 1h = 60 minutes = 1 hour.\n"},"alertThreshold":{"type":"string","description":"Valid values are: Integer[%]Specifies the value to compare (see alert_comparator) before triggering the alert actions. If expressed as a percentage, indicates value to use when\u003cspan pulumi-lang-nodejs=\" alertComparator \" pulumi-lang-dotnet=\" AlertComparator \" pulumi-lang-go=\" alertComparator \" pulumi-lang-python=\" alert_comparator \" pulumi-lang-yaml=\" alertComparator \" pulumi-lang-java=\" alertComparator \"\u003e alert_comparator \u003c/span\u003eis set to rises by perc or drops by perc.\n"},"alertTrack":{"type":"boolean","description":"Valid values: (true | false | auto) Specifies whether to track the actions triggered by this scheduled search.auto - determine whether to track or not based on the tracking setting of each action, do not track scheduled searches that always trigger actions. Default value true - force alert tracking.false - disable alert tracking for this search.\n"},"alertType":{"type":"string","description":"What to base the alert on, overriden by\u003cspan pulumi-lang-nodejs=\" alertCondition \" pulumi-lang-dotnet=\" AlertCondition \" pulumi-lang-go=\" alertCondition \" pulumi-lang-python=\" alert_condition \" pulumi-lang-yaml=\" alertCondition \" pulumi-lang-java=\" alertCondition \"\u003e alert_condition \u003c/span\u003eif it is specified. Valid values are: always, custom, number of events, number of hosts, number of sources.\n"},"allowSkew":{"type":"string","description":"Allows the search scheduler to distribute scheduled searches randomly and more evenly over their specified search periods.\n"},"autoSummarize":{"type":"boolean","description":"Indicates whether the scheduler should ensure that the data for this search is automatically summarized. Defaults to 0.\n"},"autoSummarizeCommand":{"type":"string","description":"An auto summarization template for this search. See auto summarization options in savedsearches.conf for more details.\n"},"autoSummarizeCronSchedule":{"type":"string","description":"Cron schedule that probes and generates the summaries for this saved search.The default value is _/10 _ \\* \\* \\* and corresponds to \\`every ten hours\\`.\n"},"autoSummarizeDispatchEarliestTime":{"type":"string","description":"A time string that specifies the earliest time for summarizing this search. Can be a relative or absolute time.If this value is an absolute time, use the dispatch.time_format to format the value.\n"},"autoSummarizeDispatchLatestTime":{"type":"string","description":"A time string that specifies the latest time for summarizing this saved search. Can be a relative or absolute time.If this value is an absolute time, use the dispatch.time_format to format the value.\n"},"autoSummarizeDispatchTimeFormat":{"type":"string","description":"Defines the time format that Splunk software uses to specify the earliest and latest time. Defaults to %FT%T.%Q%:z\n"},"autoSummarizeDispatchTtl":{"type":"string","description":"Valid values: Integer[p]. Defaults to 60.Indicates the time to live (in seconds) for the artifacts of the summarization of the scheduled search.\n"},"autoSummarizeMaxDisabledBuckets":{"type":"integer","description":"The maximum number of buckets with the suspended summarization before the summarization search is completely stopped, and the summarization of the search is suspended for auto_summarize.suspend_period. Defaults to 2.\n"},"autoSummarizeMaxSummaryRatio":{"type":"number","description":"The maximum ratio of summary_size/bucket_size, which specifies when to stop summarization and deem it unhelpful for a bucket. Defaults to 0.1 Note: The test is only performed if the summary size is larger than auto_summarize.max_summary_size.\n"},"autoSummarizeMaxSummarySize":{"type":"integer","description":"The minimum summary size, in bytes, before testing whether the summarization is helpful.The default value is 52428800 and is equivalent to 5MB.\n"},"autoSummarizeMaxTime":{"type":"integer","description":"Maximum time (in seconds) that the summary search is allowed to run. Defaults to 3600.Note: This is an approximate time. The summary search stops at clean bucket boundaries.\n"},"autoSummarizeSuspendPeriod":{"type":"string","description":"Time specfier indicating when to suspend summarization of this search if the summarization is deemed unhelpful.Defaults to 24h.\n"},"autoSummarizeTimespan":{"type":"string","description":"The list of time ranges that each summarized chunk should span. This comprises the list of available granularity levels for which summaries would be available. Specify a comma delimited list of time specifiers.For example a timechart over the last month whose granuality is at the day level should set this to 1d. If you need the same data summarized at the hour level for weekly charts, use: 1h,1d.\n"},"cronSchedule":{"type":"string","description":"Valid values: cron stringThe cron schedule to execute this search. For example: _/5 _ \\* \\* \\* causes the search to execute every 5 minutes.\n"},"description":{"type":"string","description":"Human-readable description of this saved search. Defaults to empty string.\n"},"disabled":{"type":"boolean","description":"Indicates if the saved search is enabled. Defaults to 0.Disabled saved searches are not visible in Splunk Web.\n"},"dispatchBuckets":{"type":"integer","description":"The maximum number of timeline buckets. Defaults to 0.\n"},"dispatchEarliestTime":{"type":"string","description":"A time string that specifies the earliest time for this search. Can be a relative or absolute time. If this value is an absolute time, use the dispatch.time_format to format the value.\n"},"dispatchIndexEarliest":{"type":"string","description":"A time string that specifies the earliest index time for this search. Can be a relative or absolute time. If this value is an absolute time, use the dispatch.time_format to format the value.\n"},"dispatchIndexLatest":{"type":"string","description":"A time string that specifies the latest index time for this search. Can be a relative or absolute time. If this value is an absolute time, use the dispatch.time_format to format the value.\n"},"dispatchIndexedRealtime":{"type":"boolean","description":"A time string that specifies the earliest time for this search. Can be a relative or absolute time. If this value is an absolute time, use the dispatch.time_format to format the value.\n"},"dispatchIndexedRealtimeMinspan":{"type":"integer","description":"Allows for a per-job override of the [search]\u003cspan pulumi-lang-nodejs=\" indexedRealtimeDiskSyncDelay \" pulumi-lang-dotnet=\" IndexedRealtimeDiskSyncDelay \" pulumi-lang-go=\" indexedRealtimeDiskSyncDelay \" pulumi-lang-python=\" indexed_realtime_disk_sync_delay \" pulumi-lang-yaml=\" indexedRealtimeDiskSyncDelay \" pulumi-lang-java=\" indexedRealtimeDiskSyncDelay \"\u003e indexed_realtime_disk_sync_delay \u003c/span\u003esetting in limits.conf.\n"},"dispatchIndexedRealtimeOffset":{"type":"integer","description":"Allows for a per-job override of the [search]\u003cspan pulumi-lang-nodejs=\" indexedRealtimeDiskSyncDelay \" pulumi-lang-dotnet=\" IndexedRealtimeDiskSyncDelay \" pulumi-lang-go=\" indexedRealtimeDiskSyncDelay \" pulumi-lang-python=\" indexed_realtime_disk_sync_delay \" pulumi-lang-yaml=\" indexedRealtimeDiskSyncDelay \" pulumi-lang-java=\" indexedRealtimeDiskSyncDelay \"\u003e indexed_realtime_disk_sync_delay \u003c/span\u003esetting in limits.conf.\n"},"dispatchLatestTime":{"type":"string","description":"A time string that specifies the latest time for this saved search. Can be a relative or absolute time.If this value is an absolute time, use the dispatch.time_format to format the value.\n"},"dispatchLookups":{"type":"boolean","description":"Enables or disables the lookups for this search. Defaults to 1.\n"},"dispatchMaxCount":{"type":"integer","description":"The maximum number of results before finalizing the search. Defaults to 500000.\n"},"dispatchMaxTime":{"type":"integer","description":"Indicates the maximum amount of time (in seconds) before finalizing the search. Defaults to 0.\n"},"dispatchReduceFreq":{"type":"integer","description":"Specifies, in seconds, how frequently the MapReduce reduce phase runs on accumulated map values. Defaults to 10.\n"},"dispatchRtBackfill":{"type":"boolean","description":"Whether to back fill the real time window for this search. Parameter valid only if this is a real time search. Defaults to 0.\n"},"dispatchRtMaximumSpan":{"type":"integer","description":"Allows for a per-job override of the [search]\u003cspan pulumi-lang-nodejs=\" indexedRealtimeMaximumSpan \" pulumi-lang-dotnet=\" IndexedRealtimeMaximumSpan \" pulumi-lang-go=\" indexedRealtimeMaximumSpan \" pulumi-lang-python=\" indexed_realtime_maximum_span \" pulumi-lang-yaml=\" indexedRealtimeMaximumSpan \" pulumi-lang-java=\" indexedRealtimeMaximumSpan \"\u003e indexed_realtime_maximum_span \u003c/span\u003esetting in limits.conf.\n"},"dispatchSpawnProcess":{"type":"boolean","description":"Specifies whether a new search process spawns when this saved search is executed. Defaults to 1. Searches against indexes must run in a separate process.\n"},"dispatchTimeFormat":{"type":"string","description":"A time format string that defines the time format for specifying the earliest and latest time. Defaults to %FT%T.%Q%:z\n"},"dispatchTtl":{"type":"string","description":"Valid values: Integer[p]. Defaults to 2p.Indicates the time to live (in seconds) for the artifacts of the scheduled search, if no actions are triggered.\n"},"displayView":{"type":"string","description":"Defines the default UI view name (not label) in which to load the results. Accessibility is subject to the user having sufficient permissions.\n"},"isScheduled":{"type":"boolean","description":"Whether this search is to be run on a schedule\n"},"isVisible":{"type":"boolean","description":"Specifies whether this saved search should be listed in the visible saved search list. Defaults to 1.\n"},"maxConcurrent":{"type":"integer","description":"The maximum number of concurrent instances of this search the scheduler is allowed to run. Defaults to 1.\n"},"name":{"type":"string","description":"A name for the search.\n","willReplaceOnChanges":true},"realtimeSchedule":{"type":"boolean","description":"Defaults to 1. Controls the way the scheduler computes the next execution time of a scheduled search. If this value is set to 1, the scheduler bases its determination of the next scheduled search execution time on the current time. If this value is set to 0, the scheduler bases its determination of the next scheduled search on the last search execution time. This is called continuous scheduling. If set to 0, the scheduler never skips scheduled execution periods. However, the execution of the saved search might fall behind depending on the scheduler load. Use continuous scheduling whenever you enable the summary index option.\n"},"requestUiDispatchApp":{"type":"string","description":"Specifies a field used by Splunk Web to denote the app this search should be dispatched in.\n"},"requestUiDispatchView":{"type":"string","description":"Specifies a field used by Splunk Web to denote the view this search should be displayed in.\n"},"restartOnSearchpeerAdd":{"type":"boolean","description":"Specifies whether to restart a real-time search managed by the scheduler when a search peer becomes available for this saved search. Defaults to 1.\n"},"runOnStartup":{"type":"boolean","description":"Indicates whether this search runs at startup. If it does not run on startup, it runs at the next scheduled time. Defaults to 0. Set to 1 for scheduled searches that populate lookup tables.\n"},"schedulePriority":{"type":"string","description":"Raises the scheduling priority of the named search. Defaults to Default\n"},"scheduleWindow":{"type":"string","description":"Time window (in minutes) during which the search has lower priority. Defaults to 0. The scheduler can give higher priority to more critical searches during this window. The window must be smaller than the search period.Set to auto to let the scheduler determine the optimal window value automatically. Requires the\u003cspan pulumi-lang-nodejs=\" editSearchScheduleWindow \" pulumi-lang-dotnet=\" EditSearchScheduleWindow \" pulumi-lang-go=\" editSearchScheduleWindow \" pulumi-lang-python=\" edit_search_schedule_window \" pulumi-lang-yaml=\" editSearchScheduleWindow \" pulumi-lang-java=\" editSearchScheduleWindow \"\u003e edit_search_schedule_window \u003c/span\u003ecapability to override auto.\n"},"search":{"type":"string","description":"Required when creating a new search.\n"},"vsid":{"type":"string","description":"Defines the viewstate id associated with the UI view listed in 'displayview'.\n"},"workloadPool":{"type":"string","description":"Specifies the new workload pool where the existing running search will be placed.`\n"}},"requiredInputs":["search"],"stateInputs":{"description":"Input properties used for looking up and filtering SavedSearches resources.\n","properties":{"acl":{"$ref":"#/types/splunk:index/SavedSearchesAcl:SavedSearchesAcl","description":"The app/user context that is the namespace for the resource\n"},"actionBetterWebhookParamBodyFormat":{"type":"string","description":"Format of the body content. Valid values are json, xml, form-urlencoded, or raw\n"},"actionBetterWebhookParamCredential":{"type":"string","description":"Name of the Splunk stored credential to use for authentication\n"},"actionBetterWebhookParamCredentials":{"type":"string","description":"Use the credentials defined in the webhook URL\n"},"actionBetterWebhookParamUrl":{"type":"string","description":"URL to send the HTTP POST request to. Must be accessible from the Splunk server\n"},"actionCreateXsoarIncident":{"type":"string","description":"Enable XSOAR alerting (Should by 1 (Enabled) or 0 (Disabled))\n"},"actionCreateXsoarIncidentParamCustomFields":{"type":"string","description":"XSOAR custom incident fields (should be a comma separated list)\n"},"actionCreateXsoarIncidentParamDetails":{"type":"string","description":"XSOAR incident description\n"},"actionCreateXsoarIncidentParamIncidentName":{"type":"string","description":"XSOAR incident name\n"},"actionCreateXsoarIncidentParamOccurred":{"type":"string","description":"XSOAR incident time\n"},"actionCreateXsoarIncidentParamSendAllServers":{"type":"string","description":"Enable XSOAR alerting sending to all servers (Should by 1 (Enabled) or 0 (Disabled)\n"},"actionCreateXsoarIncidentParamServerUrl":{"type":"string","description":"XSOAR Server instance URL (Should start with https:// || http://)\n"},"actionCreateXsoarIncidentParamSeverity":{"type":"string","description":"XSOAR Severity (1 - Low, 2 - Medium, 3 - High, 4 - Critical)\n"},"actionCreateXsoarIncidentParamType":{"type":"string","description":"XSOAR incident type\n"},"actionEmail":{"type":"boolean","description":"The state of the email action. Read-only attribute. Value ignored on POST. Use actions to specify a list of enabled actions. Defaults to 0.\n"},"actionEmailAuthPassword":{"type":"string","description":"The password to use when authenticating with the SMTP server. Normally this value is set when editing the email settings, however you can set a clear text password here and it is encrypted on the next platform restart.Defaults to empty string.\n"},"actionEmailAuthUsername":{"type":"string","description":"The username to use when authenticating with the SMTP server. If this is empty string, no authentication is attempted. Defaults to empty stringNOTE: Your SMTP server might reject unauthenticated emails.\n"},"actionEmailBcc":{"type":"string","description":"BCC email address to use if action.email is enabled.\n"},"actionEmailCc":{"type":"string","description":"CC email address to use if action.email is enabled.\n"},"actionEmailCommand":{"type":"string","description":"The search command (or pipeline) which is responsible for executing the action.Generally the command is a template search pipeline which is realized with values from the saved search. To reference saved search field values wrap them in $, for example to reference the savedsearch name use $name$, to reference the search use $search$.\n"},"actionEmailFormat":{"type":"string","description":"Valid values: (table | plain | html | raw | csv)Specify the format of text in the email. This value also applies to any attachments.\n"},"actionEmailFrom":{"type":"string","description":"Email address from which the email action originates.Defaults to splunk@$LOCALHOST or whatever value is set in alert_actions.conf.\n"},"actionEmailHostname":{"type":"string","description":"Sets the hostname used in the web link (url) sent in email actions.This value accepts two forms:hostname (for example, splunkserver, splunkserver.example.com)\n"},"actionEmailIncludeResultsLink":{"type":"integer","description":"Specify whether to include a link to the results. Defaults to 0.\n"},"actionEmailIncludeSearch":{"type":"integer","description":"Specify whether to include the search that caused an email to be sent. Defaults to 0.\n"},"actionEmailIncludeTrigger":{"type":"integer","description":"Specify whether to show the trigger condition that caused the alert to fire. Defaults to 0.\n"},"actionEmailIncludeTriggerTime":{"type":"integer","description":"Specify whether to show the time that the alert was fired. Defaults to 0.\n"},"actionEmailIncludeViewLink":{"type":"integer","description":"Specify whether to show the title and a link to enable the user to edit the saved search. Defaults to 0.\n"},"actionEmailInline":{"type":"boolean","description":"Indicates whether the search results are contained in the body of the email.Results can be either inline or attached to an email.\n"},"actionEmailMailserver":{"type":"string","description":"Set the address of the MTA server to be used to send the emails.Defaults to \u003cLOCALHOST\u003e or whatever is set in alert_actions.conf.\n"},"actionEmailMaxResults":{"type":"integer","description":"Sets the global maximum number of search results to send when email.action is enabled. Defaults to 100.\n"},"actionEmailMaxTime":{"type":"string","description":"Valid values are Integer[m|s|h|d].Specifies the maximum amount of time the execution of an email action takes before the action is aborted. Defaults to 5m.\n"},"actionEmailMessageAlert":{"type":"string","description":"Customize the message sent in the emailed alert. Defaults to: The alert condition for '$name$' was triggered.\n"},"actionEmailMessageReport":{"type":"string","description":"Customize the message sent in the emailed report. Defaults to: The scheduled report '$name$' has run\n"},"actionEmailPdfview":{"type":"string","description":"The name of the view to deliver if sendpdf is enabled\n"},"actionEmailPreprocessResults":{"type":"string","description":"Search string to preprocess results before emailing them. Defaults to empty string (no preprocessing).Usually the preprocessing consists of filtering out unwanted internal fields.\n"},"actionEmailReportCidFontList":{"type":"string","description":"Space-separated list. Specifies the set (and load order) of CID fonts for handling Simplified Chinese(gb), Traditional Chinese(cns), Japanese(jp), and Korean(kor) in Integrated PDF Rendering.If multiple fonts provide a glyph for a given character code, the glyph from the first font specified in the list is used.To skip loading any CID fonts, specify the empty string.Defaults to 'gb cns jp kor'\n"},"actionEmailReportIncludeSplunkLogo":{"type":"boolean","description":"Indicates whether to include the Splunk logo with the report.\n"},"actionEmailReportPaperOrientation":{"type":"string","description":"Valid values: (portrait | landscape)Specifies the paper orientation: portrait or landscape. Defaults to portrait.\n"},"actionEmailReportPaperSize":{"type":"string","description":"Valid values: (letter | legal | ledger | a2 | a3 | a4 | a5)Specifies the paper size for PDFs. Defaults to letter.\n"},"actionEmailReportServerEnabled":{"type":"boolean","description":"No Supported\n"},"actionEmailReportServerUrl":{"type":"string","description":"Not supported.For a default locally installed report server, the URL is http://localhost:8091/\n"},"actionEmailSendCsv":{"type":"integer","description":"Specify whether to send results as a CSV file. Defaults to 0.\n"},"actionEmailSendPdf":{"type":"boolean","description":"Indicates whether to create and send the results as a PDF. Defaults to false.\n"},"actionEmailSendResults":{"type":"boolean","description":"Indicates whether to attach the search results in the email.Results can be either attached or inline. See action.email.inline.\n"},"actionEmailSubject":{"type":"string","description":"Specifies an alternate email subject.Defaults to SplunkAlert-\u003csavedsearchname\u003e.\n"},"actionEmailTo":{"type":"string","description":"A comma or semicolon separated list of recipient email addresses. Required if this search is scheduled and the email alert action is enabled.\n"},"actionEmailTrackAlert":{"type":"boolean","description":"Indicates whether the execution of this action signifies a trackable alert.\n"},"actionEmailTtl":{"type":"string","description":"Valid values are Integer[p].Specifies the minimum time-to-live in seconds of the search artifacts if this action is triggered. If p follows \u003cInteger\u003e, int is the number of scheduled periods. Defaults to 86400 (24 hours).If no actions are triggered, the artifacts have their ttl determined by dispatch.ttl in savedsearches.conf.\n"},"actionEmailUseSsl":{"type":"boolean","description":"Indicates whether to use SSL when communicating with the SMTP server. Defaults to false.\n"},"actionEmailUseTls":{"type":"boolean","description":"Indicates whether to use TLS (transport layer security) when communicating with the SMTP server (starttls).Defaults to false.\n"},"actionEmailWidthSortColumns":{"type":"boolean","description":"Indicates whether columns should be sorted from least wide to most wide, left to right.Only valid if format=text.\n"},"actionJiraServiceDeskParamAccount":{"type":"string","description":"Jira Service Desk account name\n"},"actionJiraServiceDeskParamJiraCustomfields":{"type":"string","description":"Jira custom fields data (see https://ta-jira-service-desk-simple-addon.readthedocs.io/en/latest/userguide.html)\n"},"actionJiraServiceDeskParamJiraDescription":{"type":"string","description":"Jira issue description\n"},"actionJiraServiceDeskParamJiraIssueType":{"type":"string","description":"Jira issue type name\n"},"actionJiraServiceDeskParamJiraPriority":{"type":"string","description":"Jira priority of issue\n"},"actionJiraServiceDeskParamJiraProject":{"type":"string","description":"Jira Project name\n"},"actionJiraServiceDeskParamJiraSummary":{"type":"string","description":"Jira issue title/summary\n"},"actionLogevent":{"type":"string","description":"Enable log event action (Should be 1 (Enabled) or 0 (Disabled))\n"},"actionLogeventParamEvent":{"type":"string","description":"Specific event text for the logged event.\n"},"actionLogeventParamHost":{"type":"string","description":"Value for the host field of the logged event.\n"},"actionLogeventParamIndex":{"type":"string","description":"Destination index where to store the logged event.\n"},"actionLogeventParamSource":{"type":"string","description":"Value for the source field of the logged event.\n"},"actionLogeventParamSourcetype":{"type":"string","description":"Destination sourcetype where to store the logged event.\n"},"actionPagerdutyCustomDetails":{"type":"string","description":"The PagerDuty custom details information.\n"},"actionPagerdutyIntegrationKey":{"type":"string","description":"The PagerDuty integration Key.\n"},"actionPagerdutyIntegrationKeyOverride":{"type":"string","description":"The PagerDuty integration Key override.\n"},"actionPagerdutyIntegrationUrl":{"type":"string","description":"The pagerduty integration URL. This integration uses Splunk's native webhooks to send events to PagerDuty.\n"},"actionPagerdutyIntegrationUrlOverride":{"type":"string","description":"The pagerduty integration URL override. This integration uses Splunk's native webhooks to send events to PagerDuty.\n"},"actionPopulateLookup":{"type":"boolean","description":"The state of the populate lookup action. Read-only attribute. Value ignored on POST. Use actions to specify a list of enabled actions. Defaults to 0.\n"},"actionPopulateLookupCommand":{"type":"string","description":"The search command (or pipeline) which is responsible for executing the action.\n"},"actionPopulateLookupDest":{"type":"string","description":"Lookup name of path of the lookup to populate\n"},"actionPopulateLookupHostname":{"type":"string","description":"Sets the hostname used in the web link (url) sent in alert actions.This value accepts two forms: hostname (for example, splunkserver, splunkserver.example.com)\\n\\nprotocol://hostname:port (for example, http://splunkserver:8000, https://splunkserver.example.com:443)\n"},"actionPopulateLookupMaxResults":{"type":"integer","description":"Sets the maximum number of search results sent using alerts. Defaults to 100.\n"},"actionPopulateLookupMaxTime":{"type":"integer","description":"Valid values are: Integer[m|s|h|d]Sets the maximum amount of time the execution of an action takes before the action is aborted. Defaults to 5m.\n"},"actionPopulateLookupTrackAlert":{"type":"boolean","description":"Indicates whether the execution of this action signifies a trackable alert.\n"},"actionPopulateLookupTtl":{"type":"string","description":"Valid values are Integer[p]Specifies the minimum time-to-live in seconds of the search artifacts if this action is triggered. If p follows Integer, then this specifies the number of scheduled periods. Defaults to 10p.\n"},"actionRss":{"type":"boolean","description":"The state of the rss action. Read-only attribute. Value ignored on POST.Use actions to specify a list of enabled actions. Defaults to 0.\n"},"actionRssCommand":{"type":"string","description":"The search command (or pipeline) which is responsible for executing the action.Generally the command is a template search pipeline which is realized with values from the saved search. To reference saved search field values wrap them in $, for example to reference the savedsearch name use $name$, to reference the search use $search$.\n"},"actionRssHostname":{"type":"string","description":"Sets the hostname used in the web link (url) sent in alert actions.This value accepts two forms:hostname (for example, splunkserver, splunkserver.example.com)\\n\\nprotocol://hostname:port (for example, http://splunkserver:8000, https://splunkserver.example.com:443)\n"},"actionRssMaxResults":{"type":"integer","description":"Sets the maximum number of search results sent using alerts. Defaults to 100.\n"},"actionRssMaxTime":{"type":"integer","description":"Valid values are Integer[m|s|h|d].Sets the maximum amount of time the execution of an action takes before the action is aborted. Defaults to 1m.\n"},"actionRssTrackAlert":{"type":"boolean","description":"Indicates whether the execution of this action signifies a trackable alert.\n"},"actionRssTtl":{"type":"string","description":"Valid values are: Integer[p] Specifies the minimum time-to-live in seconds of the search artifacts if this action is triggered. If p follows Integer, specifies the number of scheduled periods. Defaults to 86400 (24 hours).\n"},"actionScript":{"type":"boolean","description":"The state of the script action. Read-only attribute. Value ignored on POST. Use actions to specify a list of enabled actions. Defaults to 0.\n"},"actionScriptCommand":{"type":"string","description":"The search command (or pipeline) which is responsible for executing the action.Generally the command is a template search pipeline which is realized with values from the saved search. To reference saved search field values wrap them in $, for example to reference the savedsearch name use $name$, to reference the search use $search$.\n"},"actionScriptFilename":{"type":"string","description":"File name of the script to call. Required if script action is enabled\n"},"actionScriptHostname":{"type":"string","description":"Sets the hostname used in the web link (url) sent in alert actions.This value accepts two forms:hostname (for example, splunkserver, splunkserver.example.com)\\n\\nprotocol://hostname:port (for example, http://splunkserver:8000, https://splunkserver.example.com:443)\n"},"actionScriptMaxResults":{"type":"integer","description":"Sets the maximum number of search results sent using alerts. Defaults to 100.\n"},"actionScriptMaxTime":{"type":"integer","description":"Valid values are Integer[m|s|h|d].Sets the maximum amount of time the execution of an action takes before the action is aborted. Defaults to 1m.\n"},"actionScriptTrackAlert":{"type":"boolean","description":"Indicates whether the execution of this action signifies a trackable alert.\n"},"actionScriptTtl":{"type":"string","description":"Valid values are: Integer[p] Specifies the minimum time-to-live in seconds of the search artifacts if this action is triggered. If p follows Integer, specifies the number of scheduled periods. Defaults to 86400 (24 hours).\n"},"actionSlackAppAlertIntegrationParamAutoJoinChannel":{"type":"string","description":"Automatically join the channel if the bot is not already a member (Should be 1 (Enabled) or 0 (Disabled))\n"},"actionSlackAppAlertIntegrationParamBotUsername":{"type":"string","description":"The bot username that will post the message\n"},"actionSlackAppAlertIntegrationParamChannel":{"type":"string","description":"Slack channel to send the message to (Should start with # or @)\n"},"actionSlackAppAlertIntegrationParamEmoji":{"type":"string","description":"Emoji icon to use as the bot's avatar (Should start and end with :)\n"},"actionSlackAppAlertIntegrationParamMessage":{"type":"string","description":"Enter the chat message to send to the Slack channel. The message can include tokens that insert text based on the results of the\n"},"actionSlackParamAttachment":{"type":"string","description":"Include a message attachment. Valid values are message, none, or alert_link\n"},"actionSlackParamChannel":{"type":"string","description":"Slack channel to send the message to (Should start with # or @)\n"},"actionSlackParamFields":{"type":"string","description":"Show one or more fields from the search results below your Slack message. Comma-separated list of field names. Allows wildcards. eg. index,source\\*\n"},"actionSlackParamMessage":{"type":"string","description":"Enter the chat message to send to the Slack channel. The message can include tokens that insert text based on the results of the search.\n"},"actionSlackParamWebhookUrlOverride":{"type":"string","description":"You can override the Slack webhook URL here if you need to send the alert message to a different Slack team\n"},"actionSnowEventParamAccount":{"type":"string","description":"Account(s) for which the event is/ are to be created across ServiceNow instance(s)."},"actionSnowEventParamAdditionalInfo":{"type":"string","description":"You can pass additional information that might be of use to the user. This field can also be used to supply the URL of your Splunk search head. When you use the snow_event.py alert-triggered script, the Splunk platform uses the URL to create a deep link that allows a ServiceNow user to navigate back to this Splunk platform search. You can find the resulting full URL for navigation from ServiceNow to the Splunk platform search by clicking Splunk Drilldown in the event page in ServiceNow. See an example below. Note that if you create events using the commands snowevent or snoweventstream, you must supply the URL in this field.You can pass the URL of Splunk as url=\u003cvalue\u003e. You can also pass other fields and their values by || separated key-value format. For example, url=\u003cvalue\u003e||k1=v1||k2=v2||...."},"actionSnowEventParamCiIdentifier":{"type":"string","description":"String that represents a configuration item in your network. You can pass value as || separated key-value format. For example, k1=v1||k2=v2."},"actionSnowEventParamCustomFields":{"type":"string","description":"The custom fields which are configured at the ServiceNow Instance. You can pass the custom fields and their values in the || separated format. For example, custom_field1=value1||custom_field2=value2||...custom_fields used must be present in the\u003cspan pulumi-lang-nodejs=\" emEvent \" pulumi-lang-dotnet=\" EmEvent \" pulumi-lang-go=\" emEvent \" pulumi-lang-python=\" em_event \" pulumi-lang-yaml=\" emEvent \" pulumi-lang-java=\" emEvent \"\u003e em_event \u003c/span\u003etable of ServiceNow."},"actionSnowEventParamDescription":{"type":"string","description":"A brief description of the event."},"actionSnowEventParamNode":{"type":"string","description":"The node, formatted to follow your organization's ITIL standards and mapping. If the node value matches a CI with the same host name, the event is automatically assigned to the matching CI."},"actionSnowEventParamResource":{"type":"string","description":"The resource, formatted to follow your organization's ITIL standards and mapping. For example, resource='CPU'."},"actionSnowEventParamSeverity":{"type":"integer","description":"The severity associated with the event. 0 - Clear 1 - Critical 2 - Major 3 - Minor 4 - Warning"},"actionSnowEventParamType":{"type":"string","description":"The type, formatted to follow your organization's ITIL standards and mapping. For example, type='Virtual Machine'."},"actionSummaryIndex":{"type":"boolean","description":"The state of the summary index action. Read-only attribute. Value ignored on POST. Use actions to specify a list of enabled actions. Defaults to 0.\n"},"actionSummaryIndexCommand":{"type":"string","description":"The search command (or pipeline) which is responsible for executing the action.Generally the command is a template search pipeline which is realized with values from the saved search. To reference saved search field values wrap them in $, for example to reference the savedsearch name use $name$, to reference the search use $search$.\n"},"actionSummaryIndexHostname":{"type":"string","description":"Sets the hostname used in the web link (url) sent in summary-index alert actions.This value accepts two forms:hostname (for example, splunkserver, splunkserver.example.com)protocol://hostname:port (for example, http://splunkserver:8000, https://splunkserver.example.com:443)\n"},"actionSummaryIndexInline":{"type":"boolean","description":"Determines whether to execute the summary indexing action as part of the scheduled search.NOTE: This option is considered only if the summary index action is enabled and is always executed (in other words, if counttype = always).Defaults to true\n"},"actionSummaryIndexMaxResults":{"type":"integer","description":"Sets the maximum number of search results sent using alerts. Defaults to 100.\n"},"actionSummaryIndexMaxTime":{"type":"integer","description":"Valid values are Integer[m|s|h|d].Sets the maximum amount of time the execution of an action takes before the action is aborted. Defaults to 1m.\n"},"actionSummaryIndexName":{"type":"string","description":"Specifies the name of the summary index where the results of the scheduled search are saved.Defaults to summary.\n"},"actionSummaryIndexTrackAlert":{"type":"boolean","description":"Indicates whether the execution of this action signifies a trackable alert.\n"},"actionSummaryIndexTtl":{"type":"string","description":"Valid values are: Integer[p] Specifies the minimum time-to-live in seconds of the search artifacts if this action is triggered. If p follows Integer, specifies the number of scheduled periods. Defaults to 86400 (24 hours).\n"},"actionVictoropsParamEnableRecovery":{"type":"string","description":"Enable sending of recovery messages (Should be 1 (Enabled) or 0 (Disabled))\n"},"actionVictoropsParamEntityId":{"type":"string","description":"Unique identifier for the affected system or service\n"},"actionVictoropsParamInactivePolls":{"type":"string","description":"Number of inactive polls before sending a recovery message\n"},"actionVictoropsParamMessageType":{"type":"string","description":"Type of VictorOps message. Valid values are info, warning, critical, recovery, ack\n"},"actionVictoropsParamMonitoringTool":{"type":"string","description":"Name of the monitoring tool sending the alert\n"},"actionVictoropsParamPollInterval":{"type":"string","description":"Polling interval for checking the status of the alert (in minutes)\n"},"actionVictoropsParamRecordId":{"type":"string","description":"Identifier used to correlate related alerts\n"},"actionVictoropsParamRoutingKeyOverride":{"type":"string","description":"You can override the VictorOps routing key here if you need to send the alert message to a different VictorOps team\n"},"actionVictoropsParamStateMessage":{"type":"string","description":"Description of the alert condition\n"},"actionWebhookParamUrl":{"type":"string","description":"URL to send the HTTP POST request to. Must be accessible from the Splunk server\n"},"actions":{"type":"string","description":"A comma-separated list of actions to enable. For example: rss,email\n"},"alertComparator":{"type":"string","description":"One of the following strings: greater than, less than, equal to, rises by, drops by, rises by perc, drops by percUsed with\u003cspan pulumi-lang-nodejs=\" alertThreshold \" pulumi-lang-dotnet=\" AlertThreshold \" pulumi-lang-go=\" alertThreshold \" pulumi-lang-python=\" alert_threshold \" pulumi-lang-yaml=\" alertThreshold \" pulumi-lang-java=\" alertThreshold \"\u003e alert_threshold \u003c/span\u003eto trigger alert actions.\n"},"alertCondition":{"type":"string","description":"Contains a conditional search that is evaluated against the results of the saved search. Defaults to an empty string.\n"},"alertDigestMode":{"type":"boolean","description":"Specifies whether alert actions are applied to the entire result set or on each individual result.Defaults to 1 (true).\n"},"alertExpires":{"type":"string","description":"Valid values: [number][time-unit]Sets the period of time to show the alert in the dashboard. Defaults to 24h.Use [number][time-unit] to specify a time. For example: 60 = 60 seconds, 1m = 1 minute, 1h = 60 minutes = 1 hour.\n"},"alertSeverity":{"type":"integer","description":"Valid values: (1 | 2 | 3 | 4 | 5 | 6) Sets the alert severity level.Valid values are:1 DEBUG 2 INFO 3 WARN 4 ERROR 5 SEVERE 6 FATAL Defaults to 3.\n"},"alertSuppress":{"type":"boolean","description":"Indicates whether alert suppression is enabled for this scheduled search.\n"},"alertSuppressFields":{"type":"string","description":"Comma delimited list of fields to use for suppression when doing per result alerting. Required if suppression is turned on and per result alerting is enabled.\n"},"alertSuppressPeriod":{"type":"string","description":"Valid values: [number][time-unit] Specifies the suppresion period. Only valid if alert.supress is enabled.Use [number][time-unit] to specify a time. For example: 60 = 60 seconds, 1m = 1 minute, 1h = 60 minutes = 1 hour.\n"},"alertThreshold":{"type":"string","description":"Valid values are: Integer[%]Specifies the value to compare (see alert_comparator) before triggering the alert actions. If expressed as a percentage, indicates value to use when\u003cspan pulumi-lang-nodejs=\" alertComparator \" pulumi-lang-dotnet=\" AlertComparator \" pulumi-lang-go=\" alertComparator \" pulumi-lang-python=\" alert_comparator \" pulumi-lang-yaml=\" alertComparator \" pulumi-lang-java=\" alertComparator \"\u003e alert_comparator \u003c/span\u003eis set to rises by perc or drops by perc.\n"},"alertTrack":{"type":"boolean","description":"Valid values: (true | false | auto) Specifies whether to track the actions triggered by this scheduled search.auto - determine whether to track or not based on the tracking setting of each action, do not track scheduled searches that always trigger actions. Default value true - force alert tracking.false - disable alert tracking for this search.\n"},"alertType":{"type":"string","description":"What to base the alert on, overriden by\u003cspan pulumi-lang-nodejs=\" alertCondition \" pulumi-lang-dotnet=\" AlertCondition \" pulumi-lang-go=\" alertCondition \" pulumi-lang-python=\" alert_condition \" pulumi-lang-yaml=\" alertCondition \" pulumi-lang-java=\" alertCondition \"\u003e alert_condition \u003c/span\u003eif it is specified. Valid values are: always, custom, number of events, number of hosts, number of sources.\n"},"allowSkew":{"type":"string","description":"Allows the search scheduler to distribute scheduled searches randomly and more evenly over their specified search periods.\n"},"autoSummarize":{"type":"boolean","description":"Indicates whether the scheduler should ensure that the data for this search is automatically summarized. Defaults to 0.\n"},"autoSummarizeCommand":{"type":"string","description":"An auto summarization template for this search. See auto summarization options in savedsearches.conf for more details.\n"},"autoSummarizeCronSchedule":{"type":"string","description":"Cron schedule that probes and generates the summaries for this saved search.The default value is _/10 _ \\* \\* \\* and corresponds to \\`every ten hours\\`.\n"},"autoSummarizeDispatchEarliestTime":{"type":"string","description":"A time string that specifies the earliest time for summarizing this search. Can be a relative or absolute time.If this value is an absolute time, use the dispatch.time_format to format the value.\n"},"autoSummarizeDispatchLatestTime":{"type":"string","description":"A time string that specifies the latest time for summarizing this saved search. Can be a relative or absolute time.If this value is an absolute time, use the dispatch.time_format to format the value.\n"},"autoSummarizeDispatchTimeFormat":{"type":"string","description":"Defines the time format that Splunk software uses to specify the earliest and latest time. Defaults to %FT%T.%Q%:z\n"},"autoSummarizeDispatchTtl":{"type":"string","description":"Valid values: Integer[p]. Defaults to 60.Indicates the time to live (in seconds) for the artifacts of the summarization of the scheduled search.\n"},"autoSummarizeMaxDisabledBuckets":{"type":"integer","description":"The maximum number of buckets with the suspended summarization before the summarization search is completely stopped, and the summarization of the search is suspended for auto_summarize.suspend_period. Defaults to 2.\n"},"autoSummarizeMaxSummaryRatio":{"type":"number","description":"The maximum ratio of summary_size/bucket_size, which specifies when to stop summarization and deem it unhelpful for a bucket. Defaults to 0.1 Note: The test is only performed if the summary size is larger than auto_summarize.max_summary_size.\n"},"autoSummarizeMaxSummarySize":{"type":"integer","description":"The minimum summary size, in bytes, before testing whether the summarization is helpful.The default value is 52428800 and is equivalent to 5MB.\n"},"autoSummarizeMaxTime":{"type":"integer","description":"Maximum time (in seconds) that the summary search is allowed to run. Defaults to 3600.Note: This is an approximate time. The summary search stops at clean bucket boundaries.\n"},"autoSummarizeSuspendPeriod":{"type":"string","description":"Time specfier indicating when to suspend summarization of this search if the summarization is deemed unhelpful.Defaults to 24h.\n"},"autoSummarizeTimespan":{"type":"string","description":"The list of time ranges that each summarized chunk should span. This comprises the list of available granularity levels for which summaries would be available. Specify a comma delimited list of time specifiers.For example a timechart over the last month whose granuality is at the day level should set this to 1d. If you need the same data summarized at the hour level for weekly charts, use: 1h,1d.\n"},"cronSchedule":{"type":"string","description":"Valid values: cron stringThe cron schedule to execute this search. For example: _/5 _ \\* \\* \\* causes the search to execute every 5 minutes.\n"},"description":{"type":"string","description":"Human-readable description of this saved search. Defaults to empty string.\n"},"disabled":{"type":"boolean","description":"Indicates if the saved search is enabled. Defaults to 0.Disabled saved searches are not visible in Splunk Web.\n"},"dispatchBuckets":{"type":"integer","description":"The maximum number of timeline buckets. Defaults to 0.\n"},"dispatchEarliestTime":{"type":"string","description":"A time string that specifies the earliest time for this search. Can be a relative or absolute time. If this value is an absolute time, use the dispatch.time_format to format the value.\n"},"dispatchIndexEarliest":{"type":"string","description":"A time string that specifies the earliest index time for this search. Can be a relative or absolute time. If this value is an absolute time, use the dispatch.time_format to format the value.\n"},"dispatchIndexLatest":{"type":"string","description":"A time string that specifies the latest index time for this search. Can be a relative or absolute time. If this value is an absolute time, use the dispatch.time_format to format the value.\n"},"dispatchIndexedRealtime":{"type":"boolean","description":"A time string that specifies the earliest time for this search. Can be a relative or absolute time. If this value is an absolute time, use the dispatch.time_format to format the value.\n"},"dispatchIndexedRealtimeMinspan":{"type":"integer","description":"Allows for a per-job override of the [search]\u003cspan pulumi-lang-nodejs=\" indexedRealtimeDiskSyncDelay \" pulumi-lang-dotnet=\" IndexedRealtimeDiskSyncDelay \" pulumi-lang-go=\" indexedRealtimeDiskSyncDelay \" pulumi-lang-python=\" indexed_realtime_disk_sync_delay \" pulumi-lang-yaml=\" indexedRealtimeDiskSyncDelay \" pulumi-lang-java=\" indexedRealtimeDiskSyncDelay \"\u003e indexed_realtime_disk_sync_delay \u003c/span\u003esetting in limits.conf.\n"},"dispatchIndexedRealtimeOffset":{"type":"integer","description":"Allows for a per-job override of the [search]\u003cspan pulumi-lang-nodejs=\" indexedRealtimeDiskSyncDelay \" pulumi-lang-dotnet=\" IndexedRealtimeDiskSyncDelay \" pulumi-lang-go=\" indexedRealtimeDiskSyncDelay \" pulumi-lang-python=\" indexed_realtime_disk_sync_delay \" pulumi-lang-yaml=\" indexedRealtimeDiskSyncDelay \" pulumi-lang-java=\" indexedRealtimeDiskSyncDelay \"\u003e indexed_realtime_disk_sync_delay \u003c/span\u003esetting in limits.conf.\n"},"dispatchLatestTime":{"type":"string","description":"A time string that specifies the latest time for this saved search. Can be a relative or absolute time.If this value is an absolute time, use the dispatch.time_format to format the value.\n"},"dispatchLookups":{"type":"boolean","description":"Enables or disables the lookups for this search. Defaults to 1.\n"},"dispatchMaxCount":{"type":"integer","description":"The maximum number of results before finalizing the search. Defaults to 500000.\n"},"dispatchMaxTime":{"type":"integer","description":"Indicates the maximum amount of time (in seconds) before finalizing the search. Defaults to 0.\n"},"dispatchReduceFreq":{"type":"integer","description":"Specifies, in seconds, how frequently the MapReduce reduce phase runs on accumulated map values. Defaults to 10.\n"},"dispatchRtBackfill":{"type":"boolean","description":"Whether to back fill the real time window for this search. Parameter valid only if this is a real time search. Defaults to 0.\n"},"dispatchRtMaximumSpan":{"type":"integer","description":"Allows for a per-job override of the [search]\u003cspan pulumi-lang-nodejs=\" indexedRealtimeMaximumSpan \" pulumi-lang-dotnet=\" IndexedRealtimeMaximumSpan \" pulumi-lang-go=\" indexedRealtimeMaximumSpan \" pulumi-lang-python=\" indexed_realtime_maximum_span \" pulumi-lang-yaml=\" indexedRealtimeMaximumSpan \" pulumi-lang-java=\" indexedRealtimeMaximumSpan \"\u003e indexed_realtime_maximum_span \u003c/span\u003esetting in limits.conf.\n"},"dispatchSpawnProcess":{"type":"boolean","description":"Specifies whether a new search process spawns when this saved search is executed. Defaults to 1. Searches against indexes must run in a separate process.\n"},"dispatchTimeFormat":{"type":"string","description":"A time format string that defines the time format for specifying the earliest and latest time. Defaults to %FT%T.%Q%:z\n"},"dispatchTtl":{"type":"string","description":"Valid values: Integer[p]. Defaults to 2p.Indicates the time to live (in seconds) for the artifacts of the scheduled search, if no actions are triggered.\n"},"displayView":{"type":"string","description":"Defines the default UI view name (not label) in which to load the results. Accessibility is subject to the user having sufficient permissions.\n"},"isScheduled":{"type":"boolean","description":"Whether this search is to be run on a schedule\n"},"isVisible":{"type":"boolean","description":"Specifies whether this saved search should be listed in the visible saved search list. Defaults to 1.\n"},"maxConcurrent":{"type":"integer","description":"The maximum number of concurrent instances of this search the scheduler is allowed to run. Defaults to 1.\n"},"name":{"type":"string","description":"A name for the search.\n","willReplaceOnChanges":true},"realtimeSchedule":{"type":"boolean","description":"Defaults to 1. Controls the way the scheduler computes the next execution time of a scheduled search. If this value is set to 1, the scheduler bases its determination of the next scheduled search execution time on the current time. If this value is set to 0, the scheduler bases its determination of the next scheduled search on the last search execution time. This is called continuous scheduling. If set to 0, the scheduler never skips scheduled execution periods. However, the execution of the saved search might fall behind depending on the scheduler load. Use continuous scheduling whenever you enable the summary index option.\n"},"requestUiDispatchApp":{"type":"string","description":"Specifies a field used by Splunk Web to denote the app this search should be dispatched in.\n"},"requestUiDispatchView":{"type":"string","description":"Specifies a field used by Splunk Web to denote the view this search should be displayed in.\n"},"restartOnSearchpeerAdd":{"type":"boolean","description":"Specifies whether to restart a real-time search managed by the scheduler when a search peer becomes available for this saved search. Defaults to 1.\n"},"runOnStartup":{"type":"boolean","description":"Indicates whether this search runs at startup. If it does not run on startup, it runs at the next scheduled time. Defaults to 0. Set to 1 for scheduled searches that populate lookup tables.\n"},"schedulePriority":{"type":"string","description":"Raises the scheduling priority of the named search. Defaults to Default\n"},"scheduleWindow":{"type":"string","description":"Time window (in minutes) during which the search has lower priority. Defaults to 0. The scheduler can give higher priority to more critical searches during this window. The window must be smaller than the search period.Set to auto to let the scheduler determine the optimal window value automatically. Requires the\u003cspan pulumi-lang-nodejs=\" editSearchScheduleWindow \" pulumi-lang-dotnet=\" EditSearchScheduleWindow \" pulumi-lang-go=\" editSearchScheduleWindow \" pulumi-lang-python=\" edit_search_schedule_window \" pulumi-lang-yaml=\" editSearchScheduleWindow \" pulumi-lang-java=\" editSearchScheduleWindow \"\u003e edit_search_schedule_window \u003c/span\u003ecapability to override auto.\n"},"search":{"type":"string","description":"Required when creating a new search.\n"},"vsid":{"type":"string","description":"Defines the viewstate id associated with the UI view listed in 'displayview'.\n"},"workloadPool":{"type":"string","description":"Specifies the new workload pool where the existing running search will be placed.`\n"}},"type":"object"}},"splunk:index/shIndexesManager:ShIndexesManager":{"description":"## # Resource:\u003cspan pulumi-lang-nodejs=\" splunk.ShIndexesManager\n\" pulumi-lang-dotnet=\" splunk.ShIndexesManager\n\" pulumi-lang-go=\" ShIndexesManager\n\" pulumi-lang-python=\" ShIndexesManager\n\" pulumi-lang-yaml=\" splunk.ShIndexesManager\n\" pulumi-lang-java=\" splunk.ShIndexesManager\n\"\u003e splunk.ShIndexesManager\n\u003c/span\u003e\nCreate indexes on Splunk Cloud instances. [BETA]\n\n## Authorization and authentication\n\nAs of now there is no support to create indexes in user-specified workspaces on Splunk Cloud.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as splunk from \"@pulumi/splunk\";\n\nconst tf_index = new splunk.ShIndexesManager(\"tf-index\", {\n    name: \"tf-test-index-0\",\n    datatype: \"event\",\n    frozenTimePeriodInSecs: \"94608000\",\n    maxGlobalRawDataSizeMb: \"100\",\n});\n```\n```python\nimport pulumi\nimport pulumi_splunk as splunk\n\ntf_index = splunk.ShIndexesManager(\"tf-index\",\n    name=\"tf-test-index-0\",\n    datatype=\"event\",\n    frozen_time_period_in_secs=\"94608000\",\n    max_global_raw_data_size_mb=\"100\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Splunk = Pulumi.Splunk;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var tf_index = new Splunk.ShIndexesManager(\"tf-index\", new()\n    {\n        Name = \"tf-test-index-0\",\n        Datatype = \"event\",\n        FrozenTimePeriodInSecs = \"94608000\",\n        MaxGlobalRawDataSizeMb = \"100\",\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi-splunk/sdk/go/splunk\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := splunk.NewShIndexesManager(ctx, \"tf-index\", \u0026splunk.ShIndexesManagerArgs{\n\t\t\tName:                   pulumi.String(\"tf-test-index-0\"),\n\t\t\tDatatype:               pulumi.String(\"event\"),\n\t\t\tFrozenTimePeriodInSecs: pulumi.String(\"94608000\"),\n\t\t\tMaxGlobalRawDataSizeMb: pulumi.String(\"100\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.splunk.ShIndexesManager;\nimport com.pulumi.splunk.ShIndexesManagerArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var tf_index = new ShIndexesManager(\"tf-index\", ShIndexesManagerArgs.builder()\n            .name(\"tf-test-index-0\")\n            .datatype(\"event\")\n            .frozenTimePeriodInSecs(\"94608000\")\n            .maxGlobalRawDataSizeMb(\"100\")\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  tf-index:\n    type: splunk:ShIndexesManager\n    properties:\n      name: tf-test-index-0\n      datatype: event\n      frozenTimePeriodInSecs: '94608000'\n      maxGlobalRawDataSizeMb: '100'\n```\n\u003c!--End PulumiCodeChooser --\u003e\n","properties":{"acl":{"$ref":"#/types/splunk:index/ShIndexesManagerAcl:ShIndexesManagerAcl"},"datatype":{"type":"string","description":"Valid values: (event | metric). Specifies the type of index.\n"},"frozenTimePeriodInSecs":{"type":"string","description":"Number of seconds after which indexed data rolls to frozen.\nDefaults to 94608000 (3 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.\n"},"maxGlobalRawDataSizeMb":{"type":"string","description":"The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.\nDefaults to 100 MB.\n"},"name":{"type":"string","description":"The name of the index to create.\n"}},"required":["acl","datatype","name"],"inputProperties":{"acl":{"$ref":"#/types/splunk:index/ShIndexesManagerAcl:ShIndexesManagerAcl"},"datatype":{"type":"string","description":"Valid values: (event | metric). Specifies the type of index.\n"},"frozenTimePeriodInSecs":{"type":"string","description":"Number of seconds after which indexed data rolls to frozen.\nDefaults to 94608000 (3 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.\n"},"maxGlobalRawDataSizeMb":{"type":"string","description":"The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.\nDefaults to 100 MB.\n"},"name":{"type":"string","description":"The name of the index to create.\n","willReplaceOnChanges":true}},"stateInputs":{"description":"Input properties used for looking up and filtering ShIndexesManager resources.\n","properties":{"acl":{"$ref":"#/types/splunk:index/ShIndexesManagerAcl:ShIndexesManagerAcl"},"datatype":{"type":"string","description":"Valid values: (event | metric). Specifies the type of index.\n"},"frozenTimePeriodInSecs":{"type":"string","description":"Number of seconds after which indexed data rolls to frozen.\nDefaults to 94608000 (3 years).Freezing data means it is removed from the index. If you need to archive your data, refer to coldToFrozenDir and coldToFrozenScript parameter documentation.\n"},"maxGlobalRawDataSizeMb":{"type":"string","description":"The maximum size of an index (in MB). If an index grows larger than the maximum size, the oldest data is frozen.\nDefaults to 100 MB.\n"},"name":{"type":"string","description":"The name of the index to create.\n","willReplaceOnChanges":true}},"type":"object"}}},"functions":{"pulumi:providers:splunk/terraformConfig":{"description":"This function returns a Terraform config object with terraform-namecased keys,to be used with the Terraform Module Provider.","inputs":{"properties":{"__self__":{"type":"ref","$ref":"#/provider"}},"type":"pulumi:providers:splunk/terraformConfig","required":["__self__"]},"outputs":{"properties":{"result":{"additionalProperties":{"$ref":"pulumi.json#/Any"},"type":"object"}},"required":["result"],"type":"object"}}}}