Splunk Enterprise Security API Reference

The Splunk Enterprise Security API allows you to use and modify findings, investigations, risk scores, assets, and identities in Splunk Enterprise Security. You can download the OpenAPI specifications:Download

Support for Splunk platform | rest command

You can use the | rest command with Splunk Enterprise Security public GET APIs. To use this command with Splunk Enterprise Security, you must do the following:

  • Add the search_format=true search parameter

  • Include quotes when using the ? character

The following search is an example that also includes the & operator:
| rest splunk_server=local "/servicesNS/nobody/missioncontrol/public/v2/investigations?search_format=true&urgency=medium"
For more details on the Splunk platform rest command, see rest in the SPL Search Reference.

Continue to navigate this API reference manual to find GET APIs available to use with Splunk Enterprise Security.