Splunk Search

Can I get data out Splunk Cloud Platform?

tienduyf9
Engager

Can I get data in Splunk Cloud Platform?
and how can i get it (REST API, library in python,...)
Any help is appreciated

Tags (1)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

You can use Splunk Python SDK to run Splunk queries.

https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/

https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtorunsearc... 

For example, if you want to get all the indexes data, you can run "| search index=*" search.

If you want to continuously get data coming to Splunk to your Python script run your search query in real-time. (https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtorunsearc...)

0 Karma

PickleRick
SplunkTrust
SplunkTrust

The question really is what is the use case. Because indeed, you can do searches on indexed data and copy it out (I'd rather not advise running a realtime search for this) but it's a highly suboptimal. If you want to copy data somewhere else apart from indexing it in splunk, you should rather use some routing within splunk and send it to another system before indexing.

tienduyf9
Engager

Looks like you are misunderstanding what I mean.
I mean I already have my data on Splunk Cloud (New Relic App) and I want to get them by python (AWS Lambda).
Can you tell me how to get the data using REST API or any other way?

tienduyf9_0-1648628958885.png

 

0 Karma

neerajs_81
Builder

https://docs.splunk.com/Documentation/Splunk/8.2.5/RESTTUT/RESTandCloud

And u can always try the AWS App for Splunk but that is for ingesting data from AWS into splunk. I think yours is other way round.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Just use the search REST API endpoint to execute a search against your splunk indexes and get the results.

0 Karma

neerajs_81
Builder

I am assuming you mean Logs.  To get logs into Splunk Cloud,  do the same thing as you do for on prem - Configure forwarders and point them to the splunk cloud indexers.

https://docs.splunk.com/Documentation/Forwarder/8.2.5/Forwarder/HowtoforwarddatatoSplunkCloud

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...