Read Splunk Logs via API

[mayankaisera]

Is there a way to read logs generated by Splunk via API or SDK, I will be very grateful if someone can please share their thoughts on this.

[burwell]

Hi. You mention logs generated by Splunk. Do you want _internal etc?

You can use API to specify an adhoc search or get the results of a previously run savedsearch or run a savedsearch that you have created before (and then you specify the time period to run the job over.)

There are Splunk SDK in many languages including Python and Java. Check out https://dev.splunk.com/enterprise/docs/welcome/

There are links to github to download working examples.

[gjanders]

You can also read the search using rest documentation