Query Federated Search for Splunk is a Splunk app that enables security teams to extend Splunk's data reach by connecting external data sources directly into Splunk's search interface and dashboards — without requiring data ingestion, indexing, centralization, or additional storage costs. The app connects to distributed data sources via pre-built API connectors, including data lakes, warehouses, object storage, SIEMs, cloud platforms, and endpoint tools. Data is normalized to the Open Cybersecurity Schema Framework (OCSF) and presented within the existing Splunk console, allowing analysts to query federated sources using a single search command from Splunk's standard search bar. Connectors are categorized as static (fixed schemas, pre-mapped to the Query Data Model) or dynamic (custom schemas with configurable mappings via a no-code schema mapping interface). This allows organizations to integrate custom application logs, vendor-specific security logs, and data stored in databases, lakehouses, warehouses, and other SIEMs. The app is available for download from Splunkbase and supports natural language search across all connected integrations. Query normalizes and delivers data without moving or storing it, so organizations do not incur additional data ingestion or compute costs. Supported connection types include Splunk-to-Splunk, Splunk-to-AWS (Athena, Security Lake, CloudWatch), Splunk-to-Datadog, Splunk-to-Microsoft (Defender 365, Sentinel, Log Analytics), and Splunk-to-CrowdStrike (Falcon API & FDR), among others.