I'm using export API for streaming the data. The use case is : I want to open a stream for a search query and want to push the data outside splunk. I'm hoping that export API will stream the live data as it gets indexed in splunk and will remain live. Is it the right way to approach ?
I'm not sure if this will work, but you will at least have to turn your search into a real-time search if you want the search to "remain live". As it is now, you will search for data from the last fifteen minutes once and then be finished.