Hi Folks,
Just getting started trying to figure out the API. My mission which I have chosen to accept is to report on how many events are returned from a search, from yesterday, each morning at open of business. I have a search;
> <search>
> <query>username@domain.com.au
> sourcetype="MSExchange:2010:MessageTracking"
> sender_username=username</query>
> <earliest>-1d@d</earliest>
> <latest>@d</latest> ...
Which is returning all the appropriate results, but is there a way to programatically grab the count of results via the API?
Once the search runs you should be able to query the REST API to find the job and grab that information: http://docs.splunk.com/Documentation/Splunk/6.4.1/RESTREF/RESTsearch#search.2Fjobs
In addition, you could also append "| stats count" to the end of your current query and that would return just a numerical value of a count of the events returned by your search.
Once the search runs you should be able to query the REST API to find the job and grab that information: http://docs.splunk.com/Documentation/Splunk/6.4.1/RESTREF/RESTsearch#search.2Fjobs
In addition, you could also append "| stats count" to the end of your current query and that would return just a numerical value of a count of the events returned by your search.
/search/jobs will give you information about all search jobs and you could filter from there.
You could also hit /search/jobs/{search_id}/timeline and you'll return a parameter for event count.
Thanks, does that mean I should GET /search/jobs//eventCount ? or do I get /search/jobs/id and eventCount is an XML element in the response which I parse?