Hi,
I am trying to automate a Splunk search and export the result to our database. Is it possible to do a search as a background job and webhook it to my API when it completes?
@AkhilKrishnaA,
You could create a scheduled alert and set webhook in the alert actions
https://docs.splunk.com/Documentation/SplunkCloud/7.0.3/Alert/Definescheduledalerts
http://docs.splunk.com/Documentation/Splunk/7.1.2/Alert/Webhooks
But which condition can I check to trigger webhook. On which index can I check the status of job.
Splunk sends the alert once the search is completed. So you could set the trigger condition based on your requirements , for e.g. "number of results" greater than 0 or number of hosts or even some custom conditions . Please see : http://docs.splunk.com/Documentation/SplunkCloud/7.0.3/Alert/AlertTriggerConditions#Workflow_for_tri...
which Index should I check? Is it possible to create an alert using Java SDK?
@AkhilKrishnaA, you search your normal data index and then set it as a scheduled search and port the results to your database.
Please refer to these documents : https://docs.splunk.com/Documentation/SplunkCloud/7.0.3/Alert/Definescheduledalerts
http://docs.splunk.com/Documentation/Splunk/7.1.2/Alert/Webhooks
Java SDK : http://dev.splunk.com/view/java-sdk/SP-CAAAEKY