Hi,
I am trying to do the following, but haven't been able to figure out how.
For a particular event, I want to trigger some analysis of the event. The analysis may involve performing additional searches using Splunk, and combining some of the results from these searches. Then finally present the final results to the user.
I looked at various options such as workflow actions, Splunk app or add-on, etc, but not exactly sure how to do that. The best I can come up with is
Create a Workflow action that triggers a POST to a URI
Create a Splunk app that listens on that URI to receive the POST
From the Splunk app, use the Splunk REST API to search based on the event received
Repeat search until all information is gathered and analyzed
Present the results in the Splunk app
Is this what I need to do? What are my options?
Thanks for your help!
... View more