attempting to query a database via the REST API (using python requests package) --
getting the session key works fine:
r = requests.post("<host>/services/auth/login",data={"username":<username>,"password":<password>},params={"output_mode":"json"})
sessionkey = r.json()['sessionKey']
and a relatively simple dbxquery call POSTs without error:
r = requests.post("<host>/services/search/jobs",headers={"Authorization":"Splunk {}".format(sessionkey)},data={"output_mode":"json","query":"| dbxquery connection='MXProd' query='SELECT * FROM mx.mx.institutions'"})
sid = r.json()['sid']
for the job ID, with the query developed based on a matching query within the web browser frontend. However, trying to pull the result of the dbxquery down results in the error:
'External search command \'dbxquery\' returned error code 1. Script output = "HTTPError: HTTP 404 Not Found -- \n In handler \'conf-db_connections\': Could not find object id=\'MXProd\'\n"'
The same query ran without issue in the frontend, and I can't seem to find anything in the API examples that would point to the error -- but clearly I'm missing a step. Any ideas?
Running Splunk Enterprise 6.4.3 and Splunk DB Connect version 2.3.1
... View more