Can I get data out Splunk Cloud Platform?

[tienduyf9]

Can I get data in Splunk Cloud Platform?
and how can i get it (REST API, library in python,...)
Any help is appreciated

[VatsalJagani]

You can use Splunk Python SDK to run Splunk queries.

https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/

https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtorunsearc... 

For example, if you want to get all the indexes data, you can run "| search index=*" search.

If you want to continuously get data coming to Splunk to your Python script run your search query in real-time. (https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtorunsearc...)

[PickleRick]

The question really is what is the use case. Because indeed, you can do searches on indexed data and copy it out (I'd rather not advise running a realtime search for this) but it's a highly suboptimal. If you want to copy data somewhere else apart from indexing it in splunk, you should rather use some routing within splunk and send it to another system before indexing.

[tienduyf9]

Looks like you are misunderstanding what I mean.
I mean I already have my data on Splunk Cloud (New Relic App) and I want to get them by python (AWS Lambda).
Can you tell me how to get the data using REST API or any other way?

[neerajs_81]

https://docs.splunk.com/Documentation/Splunk/8.2.5/RESTTUT/RESTandCloud

And u can always try the AWS App for Splunk but that is for ingesting data from AWS into splunk. I think yours is other way round.

[PickleRick]

Just use the search REST API endpoint to execute a search against your splunk indexes and get the results.

[neerajs_81]

I am assuming you mean Logs.  To get logs into Splunk Cloud,  do the same thing as you do for on prem - Configure forwarders and point them to the splunk cloud indexers.

https://docs.splunk.com/Documentation/Forwarder/8.2.5/Forwarder/HowtoforwarddatatoSplunkCloud