Splunk

This atomic allows you to fetch a list of indexes from Splunk Cloud or Splunk Enterprise.

Target: Splunk Cloud or Splunk Enterprise integration target

Steps:
- Build the query string
- Request to fetch indexes list
- Check if the request was successful:
  - If it was, attempt to extract indexes list and set the output variables
  - If it wasn't, output an error

More information about this API: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTintrospect#data.2Findexes

Splunk - Get Indexes

prod-nam

prod-eu

prod-apjc

This atomic allows you to get information about a previously executed search job from Splunk Cloud or Splunk Enterprise.

Target: Splunk Cloud or Splunk Enterprise integration target

Steps:
- Fetch the search job details
- Check if the request was successful:
  - If it was, attempt to extract Search Job data and set output results
  - If it wasn't, output an error

More information about this API for Splunk Cloud: https://docs.splunk.com/Documentation/SplunkCloud/latest/RESTREF/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7D

More information about this API for Splunk Enterprise: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7D

Splunk - Get Search Job by ID

This atomic allows you to get information about previously executed search jobs in Spunk Cloud or Splunk Enterprise.

Target: Splunk Cloud or Splunk Enterprise integration target

Steps:
- Build the query string
- Request the job information
- Check if the request was successful:
  - If it was, attempt to extract the results based on which output format was chosen and set the output variables
  - If it wasn't, output an error

More information about this API for Splunk Cloud: https://docs.splunk.com/Documentation/SplunkCloud/latest/RESTREF/RESTsearch#search.2Fjobs

More information about this API for Splunk Enterprise: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#search.2Fjobs

Splunk - Get Search Jobs

This atomic allows you to get the results from a previously executed search from Splunk Cloud or Splunk Enterprise. Note that most of this atomic's outputs will only be populated if you use "json" as the output format.

Target: Splunk Cloud or Splunk Enterprise integration target

Steps:
- Build the query string
- Request the search results
- Check if the request was successful:
  - If it was, attempt to extract the results based on which output format was chosen and set the output variables
  - If it wasn't, output an error

More information about this API for Splunk Cloud: https://docs.splunk.com/Documentation/SplunkCloud/latest/RESTREF/RESTsearch#search.2Fv2.2Fjobs.2F.7Bsearch_id.7D.2Fresults

More information about this API for Splunk Enterprise: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#search.2Fv2.2Fjobs.2F.7Bsearch_id.7D.2Fresults

Splunk - Get Search Results

This atomic allows you to run a new search in Splunk Cloud or Splunk Enterprise.

Target: Splunk Cloud or Splunk Enterprise integration target

Steps:
- Build the request payload
- Request the search be executed
- Check if the request was successful:
  - If it was, attempt to extract the results based on which output format was chosen and set the output variables
  - If it wasn't, output an error

More information about this API for Splunk Cloud: https://docs.splunk.com/Documentation/SplunkCloud/latest/RESTREF/RESTsearch#search.2Fjobs

More information about this API for Splunk Enterprise: https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#search.2Fjobs