I would like to make a REST call from Splunk. I know there are Splunk REST APIs that we can make REST calls into Splunk, but not those ones. I would like to make a REST call into other systems as a part of Splunk search. Thanks!
Search query depends upon the nature of data & what you would like to interpret from that.
Few customers are pulling ticketing information, few are pulling performance counters. Hence there is no definite answer to your question.
But search processing language remains the same e.g. stats, chart, eval, timechart etc.
Have a look on this App: https://apps.splunk.com/app/1546
It's more to use external APIs as INPUT, but if you really need to call a REST API form the search, you might need to write a custom search command for that.
Thanks. I checked the document of the App and it seems what I need. However, I could not find any example search using this capability. Does anyone happen to know where I can find those example searches using REST API Modular Input?