Splunk Search

Splunk REST API

misteryuku
Communicator

Does Splunk REST API allow us to update search results when search results are retrieved and then return the updated result back to splunk? If that's the case, what is the API for that?

Tags (4)

Damien_Dallimor
Ultra Champion

You are searching on data that has already been indexed in Splunk.

The concept of an "update" doesn't really apply as it might in the database world with SQL.

There is a Splunk "delete" search command that will "soft" delete events from the search results.

And you can certainly "insert" new events via the REST API using the Receivers endpoints, and then subsequent searches can operate on this newly inserted data. Easiest to do this using an SDK from dev.splunk.com

misteryuku
Communicator

Indexed data is diffult to modify is it?

0 Karma

misteryuku
Communicator

Can i access the data directly from the splunk server and update the data directly using the rest api without searching? Or it is impossible like what you mentioned ?

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...