Search and Retrieve Raw Events
A 3-step recipe with Splunk. We can help you get access.
Recipe · 3 steps
Search and Retrieve Raw Events
with Splunk · Observability Management
Create a search job, poll it to completion, and fetch raw events.
- Dispatch the SPL search as an asynchronous search job and capture the assigned search ID (sid).
- Poll the search job until its dispatchState reports DONE so that events are available.
- Retrieve the untransformed events of the completed search job in JSON, with optional line truncation.
What you'll need to have ready
- search: The SPL search query to execute.
- earliest_time: Earliest time boundary for the search (e.g. "-7d@d").
- latest_time: Latest time boundary for the search (e.g. "now").
- count: Maximum number of events to return.
- max_lines: Maximum number of lines per event (0 means no limit).
For your developer
Arazzo workflow splunk:search-events, 3 operations: createSearchJob → getSearchJob → getSearchEvents. Specs on APIs.io.