Splunk Search

Can I get data out Splunk Cloud Platform?

tienduyf9
Engager

Can I get data in Splunk Cloud Platform?
and how can i get it (REST API, library in python,...)
Any help is appreciated

Tags (1)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

You can use Splunk Python SDK to run Splunk queries.

https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/

https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtorunsearc... 

For example, if you want to get all the indexes data, you can run "| search index=*" search.

If you want to continuously get data coming to Splunk to your Python script run your search query in real-time. (https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtorunsearc...)

0 Karma

PickleRick
SplunkTrust
SplunkTrust

The question really is what is the use case. Because indeed, you can do searches on indexed data and copy it out (I'd rather not advise running a realtime search for this) but it's a highly suboptimal. If you want to copy data somewhere else apart from indexing it in splunk, you should rather use some routing within splunk and send it to another system before indexing.

tienduyf9
Engager

Looks like you are misunderstanding what I mean.
I mean I already have my data on Splunk Cloud (New Relic App) and I want to get them by python (AWS Lambda).
Can you tell me how to get the data using REST API or any other way?

tienduyf9_0-1648628958885.png

 

0 Karma

neerajs_81
Builder

https://docs.splunk.com/Documentation/Splunk/8.2.5/RESTTUT/RESTandCloud

And u can always try the AWS App for Splunk but that is for ingesting data from AWS into splunk. I think yours is other way round.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Just use the search REST API endpoint to execute a search against your splunk indexes and get the results.

0 Karma

neerajs_81
Builder

I am assuming you mean Logs.  To get logs into Splunk Cloud,  do the same thing as you do for on prem - Configure forwarders and point them to the splunk cloud indexers.

https://docs.splunk.com/Documentation/Forwarder/8.2.5/Forwarder/HowtoforwarddatatoSplunkCloud

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...