Splunk Search

Splunk REST API

misteryuku
Communicator

Does Splunk REST API allow us to update search results when search results are retrieved and then return the updated result back to splunk? If that's the case, what is the API for that?

Tags (4)

Damien_Dallimor
Ultra Champion

You are searching on data that has already been indexed in Splunk.

The concept of an "update" doesn't really apply as it might in the database world with SQL.

There is a Splunk "delete" search command that will "soft" delete events from the search results.

And you can certainly "insert" new events via the REST API using the Receivers endpoints, and then subsequent searches can operate on this newly inserted data. Easiest to do this using an SDK from dev.splunk.com

misteryuku
Communicator

Indexed data is diffult to modify is it?

0 Karma

misteryuku
Communicator

Can i access the data directly from the splunk server and update the data directly using the rest api without searching? Or it is impossible like what you mentioned ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...