Hi,
I am trying to do the following, but haven't been able to figure out how.
For a particular event, I want to trigger some analysis of the event. The analysis may involve performing additional searches using Splunk, and combining some of the results from these searches. Then finally present the final results to the user.
I looked at various options such as workflow actions, Splunk app or add-on, etc, but not exactly sure how to do that. The best I can come up with is
- Create a Workflow action that triggers a POST to a URI
- Create a Splunk app that listens on that URI to receive the POST
- From the Splunk app, use the Splunk REST API to search based on the event received
- Repeat search until all information is gathered and analyzed
- Present the results in the Splunk app
Is this what I need to do? What are my options?
Thanks for your help!
↧