topic Re: Splunk Enterprise Security Content management endpoint in Splunk Enterprise

..

amys — Wed, 19 Jan 2022 17:30:51 GMT

Re: Splunk Enterprise Security Content management endpoint

richgalloway — Tue, 28 Dec 2021 13:47:44 GMT

While ES has its own API endpoints (see https://docs.splunk.com/Documentation/ES/7.0.0/API/AbouttheSplunkEnterpriseSecurityAPI), it mostly uses core Splunk APIs. For correlation searches, use the savedsearches endpoints.

Re: Splunk Enterprise Security Content management endpoint

amys — Wed, 19 Jan 2022 17:31:31 GMT

Re: Splunk Enterprise Security Content management endpoint

richgalloway — Tue, 28 Dec 2021 14:58:57 GMT

The saved/searches API documentation is at https://docs.splunk.com/Documentation/Splunk/8.2.4/RESTREF/RESTsearch#saved.2Fsearches .

As for which parameters are needed for a correlation search, I recommend using GET on an known correlation search to see which parameters are populated.