I'm able to limit number of results with "head ${number}" expression but what I need is to grab a page from a search job with REST Api (for example the 3rd page of 100 elements) to limit bandwith usage when we grab search results from Splunk REST Api.
Is there a way to do this with search language or Rest API or both ?
Ludovic.
in the API you can specify an offset
argument, and a count
argument, and that will do the paging for you.
http://www.splunk.com/base/Documentation/latest/Developer/RESTSearch
More Advanced:: If you ever want to do really complex things where you actually transform the result set and then paginate the transformed result set you can do that too although it requires a lot more familiarity with the system to avoid certain pitfalls. In that case when you are making your GET request to the results
endpoint, you would use the 'search' argument. This is called a 'postprocess search' fwiw. And you can combine the search
with the offset and count args as well I believe they place nice together.
http://www.splunk.com/base/Documentation/latest/Developer/RESTSearch
in the API you can specify an offset
argument, and a count
argument, and that will do the paging for you.
http://www.splunk.com/base/Documentation/latest/Developer/RESTSearch
More Advanced:: If you ever want to do really complex things where you actually transform the result set and then paginate the transformed result set you can do that too although it requires a lot more familiarity with the system to avoid certain pitfalls. In that case when you are making your GET request to the results
endpoint, you would use the 'search' argument. This is called a 'postprocess search' fwiw. And you can combine the search
with the offset and count args as well I believe they place nice together.
http://www.splunk.com/base/Documentation/latest/Developer/RESTSearch
The link seems to be broken.