Splunk Search
Highlighted

Splunk REST API

Communicator

Does Splunk REST API allow us to update search results when search results are retrieved and then return the updated result back to splunk? If that's the case, what is the API for that?

Tags (4)
Highlighted

Re: Splunk REST API

Ultra Champion

You are searching on data that has already been indexed in Splunk.

The concept of an "update" doesn't really apply as it might in the database world with SQL.

There is a Splunk "delete" search command that will "soft" delete events from the search results.

And you can certainly "insert" new events via the REST API using the Receivers endpoints, and then subsequent searches can operate on this newly inserted data. Easiest to do this using an SDK from dev.splunk.com

Highlighted

Re: Splunk REST API

Communicator

Can i access the data directly from the splunk server and update the data directly using the rest api without searching? Or it is impossible like what you mentioned ?

0 Karma
Highlighted

Re: Splunk REST API

Communicator

Indexed data is diffult to modify is it?

0 Karma