splunk · lingy1028 · Apr 3, 2026 · Feb 19, 2026 · Feb 21, 2026 · Feb 21, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -3,6 +3,13 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/) and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [v1.4.0] - 2026-02-27
+
+### Added
+
+- Added support for POST method in the Generic Input
+- Added support for search endpoint of Webex Contact Center
+
 ## [v1.3.4] - 2026-03-30
 
 ### Fixed

diff --git a/README.md b/README.md
@@ -11,14 +11,17 @@ Find more details in our [Github Page](https://splunk.github.io/ta_cisco_webex_a
 Here are the endpoints and their mapping soucetypes.
 | Splunk Input       | Webex Endpoint        | Splunk Sourcetype               |
 |--------------------|-----------------------|---------------------------------|
+| Webex Generic Endpoint                | [Webex API](https://developer.webex.com/messaging/docs/basics)                       | cisco:webex:<**API Endpoint**>       |
 | Webex Scheduled Meetings       | [Meetings](https://developer.webex.com/docs/api/v1/meetings/list-meetings)                       | cisco:webex:meetings         |
 | Webex Meetings Summary Report       | [Meeting Usage Reports](https://developer.webex.com/docs/api/v1/meetings-summary-report/list-meeting-usage-reports)                       | cisco:webex:meeting:usage:reports         |
 | Webex Meetings Summary Report       | [Meeting Attendee Reports](https://developer.webex.com/docs/api/v1/meetings-summary-report/list-meeting-attendee-reports)                       | cisco:webex:meeting:attendee:reports             |
 | Webex Admin Audit Events       | [Admin Audit Events](https://developer.webex.com/docs/api/v1/admin-audit-events)                               | cisco:webex:admin:audit:events               |
 | Webex Meeting Qualities       | [Meeting Qualities](https://developer.webex.com/docs/api/v1/meeting-qualities/get-meeting-qualities)                               | cisco:webex:meeting:qualities              |
 | Webex Detailed Call History       | [Detailed Call History](https://developer.webex.com/docs/api/v1/reports-detailed-call-history/get-detailed-call-history)                               | cisco:webex:call:detailed_history             |
 | Webex Security Audit Events       | [Security Audit Events](https://developer.webex.com/admin/docs/api/v1/security-audit-events/list-security-audit-events)                               | cisco:webex:security:audit:events            |
-| Webex Generic Endpoint                | [Webex API](https://developer.webex.com/messaging/docs/basics)                       | cisco:webex:<**API Endpoint**>       |
+| Webex Contact Center - Search                | [Webex Contact Center - Search](https://developer.webex.com/webex-contact-center/docs/api/v1/search/search)                       | cisco:webex:contact:center:AAR cisco:webex:contact:center:ASR cisco:webex:contact:center:CAR cisco:webex:contact:center:CSR    |
+
+
 
 ## Versions Supported
 

diff --git a/docs/ConfigureGenericInput/index.md b/docs/ConfigureGenericInput/index.md
@@ -9,6 +9,8 @@ Enter a `Start Time` whenever it is supported by the endpoint to help avoid dupl
 
 Some endpoints require specific query parameters to function correctly. Users can add these parameters using the `Query Params` field. The input also supports path parameters in the URL, which should be included in the `API Endpoint` field.
 
+Most endpoints require a **GET** request. If a **POST** request is necessary, select `POST` from the `Request Method` dropdown. You may also provide the payload in the `Request Body` field if required.
+
 ## Configure Webex Generic Endpoint input through Splunk Web 
 
 1. In the **Inputs** tab select **Create New Input**.
@@ -29,4 +31,6 @@ Each attribute in the following table corresponds to a field in Splunk Web.
 |`webex_base_url`         |Webex Base API URL                |Enter the base URL for the endpoint. Most Webex APIs use `webexapis.com`, but some may require a different base URL. For example, endpoints that require the `analytics:read_all` scope often use `analytics.webexapis.com`. Always refer to the endpoint documentation to confirm the correct base URL.|
 |`start_time`             |Start Time                        |Required, Inclusive start date and time in the format `YYYY-MM-DDTHH:MM:SSZ`, e.g. `2023-01-01T00:00:00Z`.  Be aware of the endpoint limitations and valid ranges.|
 |`end_time`               |End Time                          |Optional, End date and time in the format `YYYY-Mon-DDTHH:MM:SSZ`, e.g. `2023-02-01T00:00:00Z`. Leave blank if an ongoing ingestion mode is needed. Be aware of the endpoint limitations and valid ranges.|
-|`query_params. `         |Query Params                      |Include any query parameters for the endpoint. For multiple parameters, enter them as comma-separated values (e.g. `locationId=0000000, messageId=0000000, teamId=0000000`).|
+|`method`         |Request Method                      |Required,Select the Request Method.|
+|`query_params`         |Query Params                      |Optional, Include any query parameters for the endpoint. For multiple parameters, enter them as comma-separated values (e.g. `locationId=0000000, messageId=0000000, teamId=0000000`).|
+|`request_body`         |Request Body                      |Optional, Please enter it as a JSON-formatted string. Example: {"query":"query { devices(type: CONTROLLER) { hostName ipAddress version } }","variables":{"startTime":1672531200000,"endTime":1675209600000}}|
diff --git a/docs/ConfigureWebexContactCenterSearch/index.md b/docs/ConfigureWebexContactCenterSearch/index.md
@@ -0,0 +1,41 @@
+# Webex Contact Center - Search
+
+The **Webex Contact Center - Search** input is used to fetch the data from [Webex Contact Center - Search](https://developer.webex.com/webex-contact-center/docs/api/v1/search/search) endpoint. It allows users to retrieve Agent Activity Record, Agent Session Record, Customer Activity Record, Customer Session Record.
+
+**Prerequisites**: This input is only available to Webex Contact Cetner Administrator or Supervisor.
+
+The `Start Time` is required. The Start time is inclusive and should be in the format YYYY-MM-DDTHH:MM:SSZ (example:2023-01-01T00:00:00Z). It cannot be older than 36 months from the current time. The first ingestion may pull a lot of data, please make sure you set a large interval when your Start Time is older than 1 month from current time.
+
+The `End Time` is optional. If you set it to be a specific date, only logs within the time range from Start Date to End Date will be ingested. The format should be YYYY-MM-DDTHH:MM:SSZ (example:2023-02-01T00:00:00Z). The duration between Start Time and End Time must not be more than 365 days. Leave it blank if an ongoing ingestion mode is needed.
+
+The `Query Template` is required. Please select the data source you wish to ingest into Splunk from the four options below. If you require all of them, please create four separate inputs.
+
+- Agent Activity Record(AAR): Represents an atomic step in the agent workflow.
+- Agent Session Record(ASR): Represents the agent workflow, consisting of a sequence of agent activities.
+- Customer Activity Record(CAR): Represents an atomic step in the customer workflow.
+- Customer Session Record(CSR): Represents the customer workflow, consisting of a sequence of customer activities.
+
+For more information on each data source, please check [here](https://help.webex.com/en-us/article/tajemk/Cisco-Webex-Contact-Center-Analyzer-User-Guide#reference-template_2df0d0a4-4fac-4758-82a7-1fa59961b472).
+
+The input uses checkpointing to avoid ingesting duplicate data. After the initial run, the script will save the end time of the last round as the checkpoint, and will be used as the `Start Time` (advancing by one millisecond) for the next run.
+
+## Configure Webex Security Audit Events input through Splunk Web 
+
+1. In the **Inputs** tab select **Create New Input**.
+2. Choose **Webex Contact Center - Search**.
+3. Enter the information in the related fields using the following input parameters table.
+
+## Input Parameters 
+
+Each attribute in the following table corresponds to a field in Splunk Web.
+
+|Input name               |Corresponding field in Splunk Web | Description|
+|-------------------------|----------------------------------|------------|
+|`name`                   |Name                              |A unique name for your input.|
+|`interval`               |Interval                          |Time interval of input in seconds.|
+|`index`                  |Index                             |The index in which the data should be stored. The default is <code>default</code>.|
+|`account`                |Global Account                    |The Webex account created in the Configuration tab.|
+|`org_id`             |Org ID                        |Required, Enter your Webex Contact Center Orgnization ID.|
+|`start_time`             |Start Time                        |Required, Start date and time (inclusive) in the format YYYY-MM-DDTHH:MM:SSZ, `example:2023-01-01T00:00:00Z`.|
+|`end_time`               |End Time                          |Optional, End date and time in the format YYYY-MM-DDTHH:MM:SSZ, `example:2023-02-01T00:00:00Z`. Leave it blank if an ongoing ingestion mode is needed.|
+|`query_template`               |Query Template                         |Required, ESelect the appropriate Query Template for the data source you wish to ingest.|
diff --git a/docs/Sourcetypes/index.md b/docs/Sourcetypes/index.md
@@ -3,10 +3,12 @@
 
 | Splunk Input       | Webex Endpoint        | Splunk Sourcetype               | Required Scopes                 |
 |--------------------|-----------------------|---------------------------------|---------------------------------|
+| Webex Generic Endpoint                | [Webex API](https://developer.webex.com/messaging/docs/basics)                       | cisco:webex:<**API Endpoint**>       | Refer to the endpoint documentation to confirm the required scopes      |
 | Webex Scheduled Meetings       | [Meetings](https://developer.webex.com/docs/api/v1/meetings/list-meetings)                       | cisco:webex:meetings         | meeting:admin_schedule_read spark-admin:people_read   |
 | Webex Meetings Summary Report       | [Meeting Usage Reports](https://developer.webex.com/docs/api/v1/meetings-summary-report/list-meeting-usage-reports)                       | cisco:webex:meeting:usage:reports         | meeting:admin_schedule_read meeting:admin_participants_read meeting:admin_config_read  |
 | Webex Meetings Summary Report       | [Meeting Attendee Reports](https://developer.webex.com/docs/api/v1/meetings-summary-report/list-meeting-attendee-reports)                       | cisco:webex:meeting:attendee:reports             | meeting:admin_schedule_read meeting:admin_participants_read meeting:admin_config_read  |
 | Webex Admin Audit Events       | [Admin Audit Events](https://developer.webex.com/docs/api/v1/admin-audit-events)                               | cisco:webex:admin:audit:events              | audit:events_read spark:organizations_read  |
 | Webex Meeting Qualities       | [Meeting Qualities](https://developer.webex.com/docs/api/v1/meeting-qualities/get-meeting-qualities)                               | cisco:webex:meeting:qualities              | analytics:read_all   |
 | Webex Detailed Call History       | [Detailed Call History](https://developer.webex.com/docs/api/v1/reports-detailed-call-history/get-detailed-call-history)                               | cisco:webex:call:detailed_history             | spark-admin:calling_cdr_read |
-| Webex Security Audit Events       | [Security Audit Events](https://developer.webex.com/admin/docs/api/v1/security-audit-events/list-security-audit-events)                               | cisco:webex:security:audit:events            | audit:events_read spark:organizations_read |
+| Webex Security Audit Events       | [Security Audit Events](https://developer.webex.com/admin/docs/api/v1/security-audit-events/list-security-audit-events)                               | cisco:webex:security:audit:events            | audit:events_read spark:organizations_read |
+| Webex Contact Center - Search       | [Webex Contact Center - Search](https://developer.webex.com/webex-contact-center/docs/api/v1/search/search)                               | cjp:config or cjp:config_read            | cisco:webex:contact:center:AAR cisco:webex:contact:center:ASR cisco:webex:contact:center:CAR cisco:webex:contact:center:CSR |