Splunk - Get Search Results

This atomic allows you to get the results from a previously executed search from Splunk Cloud or Splunk Enterprise. Note that most of this atomic's outputs will only be populated if you use "json" as the output format.

Target: Splunk Cloud or Splunk Enterprise integration target

Steps:

• Build the query string
• Request the search results
• Check if the request was successful:
  • If it was, attempt to extract the results based on which output format was chosen and set the output variables
  • If it wasn't, output an error

More information about this API for Splunk Cloud: https://docs.splunk.com/Documentation/SplunkCloud/latest/RESTREF/RESTsearch#search.2Fv2.2Fjobs.2F.7Bsearch_id.7D.2Fresults

More information about this API for Splunk Enterprise: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#search.2Fv2.2Fjobs.2F.7Bsearch_id.7D.2Fresults