Splunk Search

Can I get data out Splunk Cloud Platform?

tienduyf9
Engager

Can I get data in Splunk Cloud Platform?
and how can i get it (REST API, library in python,...)
Any help is appreciated

Tags (1)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

You can use Splunk Python SDK to run Splunk queries.

https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/

https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtorunsearc... 

For example, if you want to get all the indexes data, you can run "| search index=*" search.

If you want to continuously get data coming to Splunk to your Python script run your search query in real-time. (https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtorunsearc...)

0 Karma

PickleRick
SplunkTrust
SplunkTrust

The question really is what is the use case. Because indeed, you can do searches on indexed data and copy it out (I'd rather not advise running a realtime search for this) but it's a highly suboptimal. If you want to copy data somewhere else apart from indexing it in splunk, you should rather use some routing within splunk and send it to another system before indexing.

tienduyf9
Engager

Looks like you are misunderstanding what I mean.
I mean I already have my data on Splunk Cloud (New Relic App) and I want to get them by python (AWS Lambda).
Can you tell me how to get the data using REST API or any other way?

tienduyf9_0-1648628958885.png

 

0 Karma

neerajs_81
Builder

https://docs.splunk.com/Documentation/Splunk/8.2.5/RESTTUT/RESTandCloud

And u can always try the AWS App for Splunk but that is for ingesting data from AWS into splunk. I think yours is other way round.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Just use the search REST API endpoint to execute a search against your splunk indexes and get the results.

0 Karma

neerajs_81
Builder

I am assuming you mean Logs.  To get logs into Splunk Cloud,  do the same thing as you do for on prem - Configure forwarders and point them to the splunk cloud indexers.

https://docs.splunk.com/Documentation/Forwarder/8.2.5/Forwarder/HowtoforwarddatatoSplunkCloud

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...