Splunk Enterprise

Rest API to get all events

Eshwar
Engager

Hello Splunk experts,

I would like to know is there an API which can access all events which are generating in Splunk irrespective of search? Please suggest!

Thank you in advance.

Regards,

Eshwar 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The only way to retrieve events from Splunk is via a search.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Eshwar
Engager

Hi @richgalloway ,

I got it but thing here is I want to get those events which are retrieving via search through REST API because we are integrating Splunk with other tool to forward all the events. So, we are looking for an API which provides all events.

Regards,

Eshwar

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is no API that will provide every event Splunk receives.  Splunk does not want to make it easy to transition to a different product.  To use the API, you'll have to run a search (perhaps a real-time search) and collect the events from the search results.

Depending on the other tool, you may be able to use Ingest Actions to fork the data to S3 where the other tool may be able to pick them up.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Certification Support Alert | Pearson VUE Outage

Splunk Certification holders and candidates!  Please be advised of an upcoming system maintenance period for ...

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...