splunk.es.splunk_finding_info module – Gather information about Splunk Enterprise Security Findings

Note

This module is part of the splunk.es collection (version 5.1.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install splunk.es.

To use it in a playbook, specify: splunk.es.splunk_finding_info.

New in splunk.es 5.1.0

Synopsis

• This module allows for querying information about Splunk Enterprise Security Findings.

• Use this module to retrieve finding configurations without making changes.

• Query by ref_id to fetch a specific finding. Without earliest and latest.

• Query by title to filter findings by exact title match.

• Use earliest and latest to control the time range of returned findings.

• By default, if earliest and latest are not specified, findings from the last 24 hours are returned.

• This default time (24 hours) range applies when querying by title or all findings (not by ref_id).

• This module uses the httpapi connection plugin and does not require local Splunk SDK.

Note

This module has a corresponding action plugin.

Parameters

Parameter	Comments
api_app string	The app portion of the Splunk API path for the findings endpoint. Override this if your environment uses a different app name. Default: "SplunkEnterpriseSecuritySuite"
api_namespace string	The namespace portion of the Splunk API path. Override this if your environment uses a different namespace. Default: "servicesNS"
api_user string	The user portion of the Splunk API path. Override this if your environment requires a different user context. Default: "nobody"
earliest string	The earliest time for findings to return. All findings returned have a _time greater than or equal to this value. Accepts relative time (e.g. -30m, -7d, -1w), epoch time, or ISO 8601 time. If not provided, defaults to the last 24 hours (-24h). Ignored when querying by ref_id (time is extracted from ref_id automatically). Applies when querying by title or all findings.
latest string	The latest time for findings to return. All findings returned have a _time less than or equal to this value. Accepts relative time (e.g. -30m, now), epoch time, or ISO 8601 time. If not provided, defaults to the current time (now). Ignored when querying by ref_id (time is extracted from ref_id automatically). Applies when querying by title or all findings.
limit integer	Maximum number of findings to return. If not specified, all matching findings are returned. Use this to limit large result sets.
ref_id string	Reference ID (finding ID) to query a specific finding. If specified, returns only the finding with this ID. Takes precedence over title if both are provided. The time is automatically extracted from the ref_id (format uuid@@notable@@time{timestamp}). When querying by ref_id, the earliest and latest parameters are ignored.
title string	Title name to filter findings. Returns all findings with an exact title match. Ignored if ref_id is provided. The earliest and latest time filters still apply when querying by title.

Examples

- name: Query specific finding by ref_id (time extracted automatically from ref_id)
  splunk.es.splunk_finding_info:
    ref_id: "abc-123-def-456@@notable@@time1234567890"
  register: result

- name: Display the finding info
  debug:
    var: result.findings

- name: Query findings by title (from last 24 hours by default)
  splunk.es.splunk_finding_info:
    title: "Suspicious Login Activity"
  register: result

- name: Query findings by title from the last 7 days
  splunk.es.splunk_finding_info:
    title: "Suspicious Login Activity"
    earliest: "-7d"
  register: result

- name: Display findings with matching title
  debug:
    var: result.findings

- name: Query all findings (from last 24 hours by default)
  splunk.es.splunk_finding_info:
  register: all_findings

- name: Display all findings
  debug:
    var: all_findings.findings

- name: Query all findings from the last 7 days
  splunk.es.splunk_finding_info:
    earliest: "-7d"
    latest: "now"
  register: all_findings

- name: Query all findings from the last 30 days
  splunk.es.splunk_finding_info:
    earliest: "-30d"
  register: all_findings

- name: Query findings with a limit on results
  splunk.es.splunk_finding_info:
    earliest: "-7d"
    limit: 100
  register: limited_findings

- name: Query findings from a specific time range (ISO 8601)
  splunk.es.splunk_finding_info:
    earliest: "2026-01-01T00:00:00"
    latest: "2026-01-07T23:59:59"
  register: all_findings

- name: Filter findings by status using Jinja2
  splunk.es.splunk_finding_info:
    earliest: "-7d"
  register: all_findings

# Query findings with custom API path (for non-standard environments)
- name: Query findings with custom API path
  splunk.es.splunk_finding_info:
    earliest: "-7d"
    api_namespace: "{{ es_namespace | default('servicesNS') }}"
    api_user: "{{ es_user | default('nobody') }}"
    api_app: "{{ es_app | default('SplunkEnterpriseSecuritySuite') }}"
  register: custom_findings

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Description
findings list / elements=dictionary	List of findings matching the query Returned: always Sample: [{"description": "Multiple failed login attempts detected", "disposition": "undetermined", "entity": "testuser", "entity_type": "user", "finding_score": 50, "owner": "admin", "ref_id": "abc-123-def-456", "security_domain": "access", "status": "new", "title": "Suspicious Login Activity", "urgency": "high"}]
description string	Description of the finding Returned: success
disposition string	Disposition of the finding Returned: success
entity string	The risk object (entity) associated with the finding Returned: success
entity_type string	Type of the risk object (user or system) Returned: success
finding_score integer	Risk score of the finding Returned: success
owner string	Owner of the finding Returned: success
ref_id string	The unique reference ID of the finding Returned: success
security_domain string	Security domain of the finding Returned: success
status string	Status of the finding Returned: success
title string	Title of the finding Returned: success
urgency string	Urgency level of the finding Returned: success

Authors

• Ron Gershburg (@rgershbu)

Collection links

• Issue Tracker
• Repository (Sources)