Building for the Splunk Platform

How to Export Data via Webhooks?


Dear Splunk Experts and Community,

We are interested in receiving notifications as often as possible when an event is received into Splunk.  We have currently set up a Saved Search that has an action of Webhook to send us alerts every few minutes which is working ok for us. However, as we are new to this system we aren't sure if there is a better way to implement a feed from Splunk to our API.

Any additional suggestions?




Labels (1)
Tags (2)
0 Karma


Using a webhook like this is the option with the least coding required. If you're in need of something more realtime, you could also write an application to poll for results via the REST API at a more frequent interval. Or, you can use real-time searches (either as a saved search with a webhook attached or using an external application for polling), but these can have a significant impact on Splunk's performance if you're not careful, so I'd caution against that option.

If the search you're using with the webhook action is performant enough (restricted to a narrow dataset, no subsearches, etc) you may be able to increase the frequency at which it runs - even down to as low as every minute. This can still have some negative impact on the scheduler depending on how many other searches you're running though. Unfortunately there's no one-size-fits-all answer here.

Is it possible to have the application you're integrating with query Splunk when needed, instead of pushing notifications from Splunk into the application?

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...