Splunk Search

Using the Rest API endpoint, how do i know if a search Completed successfully or errored out?

Genti
Splunk Employee
Splunk Employee

So reading the documentation on http://www.splunk.com/base/Documentation/latest/Developer/RESTSearch#Search_ID it seems that there is a flag/attribute for when a search has completed.

isDone = 0 | 1    
    * Is the search finished? 

But how can i tell if the search completed successfully or not? Is the isDone =1 true for a failed search as well as a successful search?

0 Karma
1 Solution

Genti
Splunk Employee
Splunk Employee

Just tested this.
If i run a search that completes successfully i get the:

isDone = 0 | 1
    * Is the search finished? 

However the same key is set when a search is also not successful, ie. fails. However, when this happens another attribute can be helpful and tell me that the search actually failed:

  isDone     1  
  isFailed   1

Moreover under the messages attribute you should see an error message such as:

messages    
  fatal     
   1. Error in 'eval' command: The operator at '\0' is invalid.

Hope this helps others out there
Cheers,
.gz

View solution in original post

Genti
Splunk Employee
Splunk Employee

Just tested this.
If i run a search that completes successfully i get the:

isDone = 0 | 1
    * Is the search finished? 

However the same key is set when a search is also not successful, ie. fails. However, when this happens another attribute can be helpful and tell me that the search actually failed:

  isDone     1  
  isFailed   1

Moreover under the messages attribute you should see an error message such as:

messages    
  fatal     
   1. Error in 'eval' command: The operator at '\0' is invalid.

Hope this helps others out there
Cheers,
.gz

Jordan_Brough
Path Finder

An easy way to produce a failed job:

curl -u user:password -k https://localhost:8089/services/search/jobs -d'search=| eval x'

(some types of errors fail before even turning into a job)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...