How to Export Data via Webhooks?

[ecrowe]

Dear Splunk Experts and Community,

We are interested in receiving notifications as often as possible when an event is received into Splunk.  We have currently set up a Saved Search that has an action of Webhook to send us alerts every few minutes which is working ok for us. However, as we are new to this system we aren't sure if there is a better way to implement a feed from Splunk to our API.

Any additional suggestions?

Thanks!

[mcmaster]

Using a webhook like this is the option with the least coding required. If you're in need of something more realtime, you could also write an application to poll for results via the REST API at a more frequent interval. Or, you can use real-time searches (either as a saved search with a webhook attached or using an external application for polling), but these can have a significant impact on Splunk's performance if you're not careful, so I'd caution against that option.

If the search you're using with the webhook action is performant enough (restricted to a narrow dataset, no subsearches, etc) you may be able to increase the frequency at which it runs - even down to as low as every minute. This can still have some negative impact on the scheduler depending on how many other searches you're running though. Unfortunately there's no one-size-fits-all answer here.

Is it possible to have the application you're integrating with query Splunk when needed, instead of pushing notifications from Splunk into the application?