Put Splunk Search Results in Your Own App's Data Grid

Splunk search results can be displayed in your custom application using the Lattice Grid framework. This solution is beneficial for users who need to view events in your application, not Splunk, and may not have a Splunk license. The Lattice Grid provides a Splunk adapter that handles the translation between your application's grid and Splunk's search REST API.

The adapter performs a search job, watches it, reads a window of results, and cancels the job when the grid requests a different set of data. The adapter supports three methods for handling credentials based on the page's intended audience.

In production environments, a proxy server is recommended. The application authenticates visitors, and a small backend holds the Splunk service token. The proxy forwards only the necessary search endpoints, restricts index permissions, implements rate-limiting, and adds cross-origin headers. Your custom application interacts with this proxy, never directly accessing the Splunk token.

For internal tools, a per-user session key can be used. Each user signs into Splunk using their own account, and the page stores their short-lived session key in memory. The adapter fetches the session key from Splunk during login and uses it to make subsequent requests.

The adapter ensures that users see only the rows within the specified time window. It converts time filters into the job's window, making Splunk seek to the time range instead of reading the entire dataset and discarding most of it. This approach allows for faster filtering and avoids silent gaps between the user's filter and the rows displayed.