Splunk API (and/or ODBC)

Splunk offers a robust API that is capable of querying data from a Search Head. Splunk documentation for the REST API can be found here. Splunk documentation for the Splunk ODBC Driver can be found at https://docs.splunk.com/Documentation/ODBC.

Due to limitations in the Splunk application with SAML and Splunk only integrating with a single external authentication provider, authentication to the API (or ODBC) is not integrated with network logins at this time and a dedicated “Splunk Auth” account must be used. An enhancement request has been filed for this limitation.

1. Request an API account by emailing TechSvcsSplunkReq@illinois.edu or via the form at https://go.illinois.edu/newsplunkapi
   (When provisioned, you can test your Service Account (and assess it’s default settings, permissions, etc.) by logging in to the Web UI at the following URL:  https://illinois.splunkcloud.com/en-US/account/login?loginType=splunk )
2. Format a query against the API. The syntax in the search string will follow Splunk Search Processing Language (SPL)
   1. A simple example

      $ curl -u 'splunk-auth-username:password' https://illinois.splunkcloud.com:8089/services/search/jobs/export -d search="search index=main earliest=-1d@d latest=@d | stats count by host" -d output_mode=json

   2. A modification of the above example – where one can specify user (in this case “sa-myserviceaccount”) and app (“uofi_urb_myunit”) context:

      $ curl -u 'splunk-auth-username:password' https://illinois.splunkcloud.com:8089/servicesNS/sa-myserviceaccount/uofi_urb_myunit/search/jobs/export -d search="search index=main earliest=-1d@d latest=@d | stats count by host" -d output_mode=json

API Environments

Environment	URL
Production – Search Cloud	https://illinois.splunkcloud.com:8089
Test – Search Cloud	https://dev-illinois.splunkcloud.com:8089