topic Re: Get data out Splunk Cloud Platform in Splunk Search

Can I get data out Splunk Cloud Platform?

tienduyf9 — Wed, 30 Mar 2022 17:26:32 GMT

Can I get data in Splunk Cloud Platform?
and how can i get it (REST API, library in python,...)
Any help is appreciated

Re: Get data out Splunk Cloud Platform

neerajs_81 — Wed, 30 Mar 2022 06:13:06 GMT

I am assuming you mean Logs. To get logs into Splunk Cloud, do the same thing as you do for on prem - Configure forwarders and point them to the splunk cloud indexers.

https://docs.splunk.com/Documentation/Forwarder/8.2.5/Forwarder/HowtoforwarddatatoSplunkCloud

Re: Get data out Splunk Cloud Platform

tienduyf9 — Wed, 30 Mar 2022 08:31:13 GMT

Looks like you are misunderstanding what I mean.
I mean I already have my data on Splunk Cloud (New Relic App) and I want to get them by python (AWS Lambda).
Can you tell me how to get the data using REST API or any other way?

Re: Get data out Splunk Cloud Platform

PickleRick — Wed, 30 Mar 2022 10:30:31 GMT

Just use the search REST API endpoint to execute a search against your splunk indexes and get the results.

Re: Get data out Splunk Cloud Platform

neerajs_81 — Wed, 30 Mar 2022 11:33:18 GMT

https://docs.splunk.com/Documentation/Splunk/8.2.5/RESTTUT/RESTandCloud

And u can always try the AWS App for Splunk but that is for ingesting data from AWS into splunk. I think yours is other way round.

Re: Get data out Splunk Cloud Platform

VatsalJagani — Wed, 30 Mar 2022 17:13:39 GMT

You can use Splunk Python SDK to run Splunk queries.

https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/

https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtorunsearchespython/

For example, if you want to get all the indexes data, you can run "| search index=*" search.

If you want to continuously get data coming to Splunk to your Python script run your search query in real-time. (https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtorunsearchespython/#To-create-a-basic-export-search-and-display-results)

Re: Get data out Splunk Cloud Platform

PickleRick — Wed, 30 Mar 2022 17:27:37 GMT

The question really is what is the use case. Because indeed, you can do searches on indexed data and copy it out (I'd rather not advise running a realtime search for this) but it's a highly suboptimal. If you want to copy data somewhere else apart from indexing it in splunk, you should rather use some routing within splunk and send it to another system before indexing.