- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
amys
Engager
12-27-2021
10:21 PM
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
richgalloway
SplunkTrust
12-28-2021
05:47 AM
While ES has its own API endpoints (see https://docs.splunk.com/Documentation/ES/7.0.0/API/AbouttheSplunkEnterpriseSecurityAPI), it mostly uses core Splunk APIs. For correlation searches, use the savedsearches endpoints.
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
richgalloway
SplunkTrust
12-28-2021
05:47 AM
While ES has its own API endpoints (see https://docs.splunk.com/Documentation/ES/7.0.0/API/AbouttheSplunkEnterpriseSecurityAPI), it mostly uses core Splunk APIs. For correlation searches, use the savedsearches endpoints.
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
amys
Engager
12-28-2021
06:03 AM
..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
richgalloway
SplunkTrust
12-28-2021
06:58 AM
The saved/searches API documentation is at https://docs.splunk.com/Documentation/Splunk/8.2.4/RESTREF/RESTsearch#saved.2Fsearches .
As for which parameters are needed for a correlation search, I recommend using GET on an known correlation search to see which parameters are populated.
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.