Getting Data In

REST API - Creating a Search

kvmadan
Explorer

As mentioned in the documentation i am trying to create a search but I'm not getting the expected response.
https://docs.splunk.com/Documentation/Splunk/8.0.1/RESTTUT/RESTsearches#Tips_on_accessing_searches

I'm getting below response.

<title>jobs</title>
<id>https://xyz:8089/services/search/jobs</id>
<updated>2020-02-03T06:11:04-08:00</updated>
<generator build="7af3758d0d5e" version="7.3.3"/>
<author>
    <name>Splunk</name>
</author>
<opensearch:totalResults>0</opensearch:totalResults>
<opensearch:itemsPerPage>0</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>

As per the documentation, i am suppose to receive the sid.
Can someone help, what is going wrong?

Tags (3)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Are you GETing or POSTing?

View solution in original post

niketn
Legend

@kvmadan can you try the following REST API?

https://xyz:8089/servicesNS/-/-/search/jobs

instead of https://xyz:8089/services/search/jobs and confirm?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

kvmadan
Explorer

It doesnt work for me.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Are you GETing or POSTing?

jkat54
SplunkTrust
SplunkTrust

curl -XPOST -k https://..

kvmadan
Explorer

Thank you. I got it now, i think the search should start with search command.
curl -XPOST -k https://splunk.xyz.net:8089/services/search/jobs -d search="search host=datacenter* AND sourcetype=absd:log "IzV2xyzSubmissionDebug" "absd_time" index=datacenter"

0 Karma

kvmadan
Explorer

Another followup question.
I'm able to submit the job but the results are empty once the job's dispatchstate is DONE.
the same search query, when i execute in the Splunk UI, it returns the results.
I also treed limiting the results to last 24h by appending earliest=-24h

Is there anything wrong i am doing?

0 Karma

jkat54
SplunkTrust
SplunkTrust

Is your new problem related to knowledge object sharing/permissions and the API namespace you're using?

For example, if your search works in "searching and reporting" app (aka "search") when ran as "username" but doesn't work in "launcher" app... or as another user in search app...

You would use curl.... localhost:port/servicesNS/username/search

If it only works for admin:

/servicesNS/admin/search

0 Karma

kvmadan
Explorer

No, the search query can work in any app with admin/my user.

0 Karma

jkat54
SplunkTrust
SplunkTrust

I converted my comments to an answer, please accept if it helped.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Did you specify the search as show in that documentation page?

kvmadan
Explorer

I'm sending the request through postman
below is what i am sending. .
https://splunk.xyx.net:8089/services/search/jobs?search=sourcetype=sp:wf_log "IAV2testSubmissionDebug" "xyz_time" index=datacenter

and above is the response i got with 200OK.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Please share your curl command.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...