Hi,
We recently had a temporary problem with a license configuration which produced warnings when searching in the Splunk UI.
Running the same search via the REST API and using output_mode set to 'json' while the warnings were still unresolved resulted in an empty result set ("[]") response rather than any type of error or warning. The search I was running normally would have returned two results.
I ran the same search using the default XML output_mode and the same warnings that were in the UI showed up in the XML as <msg type="WARN"> elements.
Is there a way to get the warnings to show up in the JSON output which is considerably easier to parse (I'm using Python)? We resolved the cause of the warnings but I don't want to rely on JSON output if it ignores warnings and acts the same as if there were no matches to the search.
Thanks in advance!
--jean
I don't think you will get these warning messages as part of requests to other endpoints than the ones that specifically will give you this information. The ones I imagine would be of relevance to you are: