Splunk Cloud: How to Collect Data in JSON Format from Splunk Cloud?

[franraf180]

Hello everyone,

I'm trying to collect data in JSON format from Splunk Cloud, and I understand that one of the options is using the REST API. However, I'm not sure which endpoint I should use, or if there's another recommended way to achieve this directly from Splunk Cloud.

I've been testing with the following endpoints:

• /services/search/jobs/
• /servicesNS/admin/search/search/jobs

But in both cases, I only get a 404 error indicating that the URL is not valid.

Could you guide me on how to configure data collection in this format?

• What would be the correct endpoint?
• Which key parameters should I include in my request?

Or, if there's an easier or more direct method, I'd appreciate it if you could explain.

The version of Splunk I'm using is 9.3.2408.104.

Thank you in advance for your help!

[isoutamo]

If I recall right you must “enable” REST api first with support ticket or using ACS by enabling some networks to search-api. https://docs.splunk.com/Documentation/SplunkCloud/latest/RESTTUT/RESTandCloud
After that you can query via rest endpoints.