Splunk Dev

How to Export Data via Webhooks?


Dear Splunk Experts and Community,

We are interested in receiving notifications as often as possible when an event is received into Splunk.  We have currently set up a Saved Search that has an action of Webhook to send us alerts every few minutes which is working ok for us. However, as we are new to this system we aren't sure if there is a better way to implement a feed from Splunk to our API.

Any additional suggestions?




Labels (1)
Tags (2)
0 Karma


Using a webhook like this is the option with the least coding required. If you're in need of something more realtime, you could also write an application to poll for results via the REST API at a more frequent interval. Or, you can use real-time searches (either as a saved search with a webhook attached or using an external application for polling), but these can have a significant impact on Splunk's performance if you're not careful, so I'd caution against that option.

If the search you're using with the webhook action is performant enough (restricted to a narrow dataset, no subsearches, etc) you may be able to increase the frequency at which it runs - even down to as low as every minute. This can still have some negative impact on the scheduler depending on how many other searches you're running though. Unfortunately there's no one-size-fits-all answer here.

Is it possible to have the application you're integrating with query Splunk when needed, instead of pushing notifications from Splunk into the application?

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...