capabilities.work

Ingest Raw Data then Search for It

A 4-step recipe with Splunk. We can help you get access.

Recipe · 4 steps

Ingest Raw Data then Search for It

with Splunk · Observability Management

Send raw data to HEC, then dispatch and poll a search that finds it.

  1. Post raw text to the HEC raw endpoint with index, source, and sourcetype overrides.
  2. Dispatch an SPL search against the target index to confirm the ingested data is searchable.
  3. Poll the search job until its dispatchState reports DONE.
  4. Retrieve the search results to confirm the raw data was indexed and is now searchable.
What you'll need to have ready
  • hecAuthorization: The HEC Authorization header value, formatted as "Splunk <token>".
  • rawData: The raw, unstructured text to ingest.
  • index: Destination index for the raw data and target of the search.
  • sourcetype: Source type override for the raw data.
  • source: Source override for the raw data.
  • search: The SPL search query used to verify the data (e.g. "search index=main").
  • count: Maximum number of results to return.
For your developer

Arazzo workflow splunk:raw-ingest-and-search, 4 operations: sendRawEvent → createSearchJob → getSearchJob → getSearchResults. Specs on APIs.io.

More recipes with Splunk

Finalize, Read, and Clean Up a Search JobHEC Ingest an Event and Confirm IndexingProvision an Index and Attach a Monitor InputRun a Search Job and Retrieve ResultsSearch and Retrieve Raw Events