Getting Data In

Issues with API using curl - "Method not allowed"

msarro
Builder

I am just starting to dabble with the splunk API. I am following the examples shown in the splunk documentation. The following command gives the following results:

[root@splunk-serv ~]# curl -u admin:changeme -k https://localhost:8089/services/search/jobs/1299860329.83/results/ -d"output_mode=csv"
<?xml version='1.0' encoding='UTF-8'?>
<response><messages><msg type='FATAL'>Method Not Allowed</msg></messages></response>

Can anyone provide any pointers on why everything else in the documentation seems to work alright, but this doesn't? Am I querying incorrectly?

Tags (1)

jsperry
Engager

so I've been playing with this, and found that if you add -G to the command, it will work.

man curl:
-G/--get
When used, this option will make all data specified with -d/--data or --data-binary to be used in a HTTP GET request instead of the POST request that otherwise would be used. The data will be appended to
the URL with a '?' separator.

Stephen_Sorkin
Splunk Employee
Splunk Employee

The problem is that using -d"..." causes curl to POST, rather than GET, the resource, which is disallowed from the REST perspective. It should work if you use GET arguments:

curl -u admin:changeme 'https://localhost:8089/services/search/jobs/1299860329.83/results?output_mode=csv'

Stephen_Sorkin
Splunk Employee
Splunk Employee

If that response is empty, that means that the search job had no results. What if you ask for the XML version of the results?

0 Karma

msarro
Builder

When I try this from the command line I get an error stating that the site certificate isn't correct. When I add the --insecure flag, it simply returns to the command prompt.

[root@splunk-serv ~]# curl -u admin:changeme --insecure 'https://localhost:8089/services/search/jobs/1300110780.86/results?output_mode=csv'
[root@splunk-serv ~]#

Going to the same URL via a browser simply shows a blank screen.

0 Karma

msarro
Builder

So the actual documentation is incorrect then? If so I'll submit a support ticket. It seems like a pretty big flaw.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...