When ever a particular search query matches in splunk i would like to send the search result to a rest api

Question

I am new to Splunk and its apps.

My Requirement is When Splunk got the particular logging like "Login Success" i would like to send that whole message to a rest API.

I can use a scheduler to call Splunk-Api and get the result, but i don't want to use any schedulers.

How we can implement this in Splunk itself.

Answer 1

Create an alert with a web hook.

First, define a search to locate the desired text. Then save that search as an alert. Schedule the alert to run at the desired interval. Finally, select the trigger action Webhook and enter the URL.