That's the beauty; you get to decide! There is a very substantial pool of existing correlation searches that you can enable and if your desired search doesn't exist, you can create it. I guess the bast answer is "correlated attacks" and by that I mean that various things happen in multiple systems close to eachother in time. That is really the power of Splunk/ES.
... View more
Ah, ok. I recommend starting here: http://docs.splunk.com/Documentation/Splunk/6.5.0/RESTTUT/RESTbasicexamples
Generally the API is used by other systems to run searches against Splunk to bring the data back for further manipulation or visualization, or to actually interact and manage Splunk.
The dev guide should have all you need to get started.
... View more