Getting Data In

How read the data from splunk using search query using postman (not curl )get reuest.

New Member

I want to know using postman how can find the result of below query
sourcetype="httpevent" 69272d19-53a9-4539-b149-9fc46bbc73cf

please find the attached image alt text

0 Karma

Path Finder

There is a pretty good documentation available on Splunk website related to Splunk REST API.
You might want to have a look at it. The link below is related to Search endpoint:

But basically what you need is:
1) url is https://splunkserver:8089/services/jobs/export (export - to export search results, there are other search endpoints available too)
2) use basic authentication with your login name and password
3) method either POST or GET (see the docs), but let's say you use POST
4) as request parameters (key / value pairs in Params tab in Postman) use (note, colon below is a separator between key and value):

earliest_time :  -1h   (last 1 hour)
latest_time : now
output_mode : json  (or csv or xml, see the docs)
search : sourcetype="httpevent" 69272d19-53a9-4539-b149-9fc46bbc73cf

Results of the query will be in the format you specified in output_mode parameter.

0 Karma


@kadamshridhar01 sorry your question is not clear. Do you need help with sending data through HEC (via Postman) to Splunk? Or you are already sending data to Splunk and need help with writing SPL?

| makeresults | eval message= "Happy Splunking!!!"
0 Karma

New Member

@niketnilay .Already data present in splunk .i want to retrieve it through postman with search criteria .I am new to splunk .what is SPL ?
If you give me below details retrieve data from splunk.
1)Request type (get/post) and url(https://localhost:8089/?)
2)request body if any require and format
3)headers list with value .

Currently i am able to hit request splunk using basic auth but I don't understand how to set search criteria to get data

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...