dvcrn Splunk
Data analytics and SIEM.
Environment
export SPLUNK_URL="https://splunk.example.com:8089"
export SPLUNK_TOKEN="xxxxxxxxxx"
Run Search
curl -X POST "$SPLUNK_URL/services/search/jobs" \
-H "Authorization: Bearer $SPLUNK_TOKEN" \
-d "search=search index=main | head 10"
Get Search Results
curl "$SPLUNK_URL/services/search/jobs/{sid}/results?output_mode=json" \
-H "Authorization: Bearer $SPLUNK_TOKEN"
List Saved Searches
curl "$SPLUNK_URL/services/saved/searches?output_mode=json" \
-H "Authorization: Bearer $SPLUNK_TOKEN"