So reading the documentation on http://www.splunk.com/base/Documentation/latest/Developer/RESTSearch#Search_ID it seems that there is a flag/attribute for when a search has completed.
isDone = 0 | 1
* Is the search finished?
But how can i tell if the search completed successfully or not? Is the isDone =1 true for a failed search as well as a successful search?
Just tested this.
If i run a search that completes successfully i get the:
isDone = 0 | 1
* Is the search finished?
However the same key is set when a search is also not successful, ie. fails. However, when this happens another attribute can be helpful and tell me that the search actually failed:
isDone 1
isFailed 1
Moreover under the messages attribute you should see an error message such as:
messages
fatal
1. Error in 'eval' command: The operator at '\0' is invalid.
Hope this helps others out there
Cheers,
.gz
Just tested this.
If i run a search that completes successfully i get the:
isDone = 0 | 1
* Is the search finished?
However the same key is set when a search is also not successful, ie. fails. However, when this happens another attribute can be helpful and tell me that the search actually failed:
isDone 1
isFailed 1
Moreover under the messages attribute you should see an error message such as:
messages
fatal
1. Error in 'eval' command: The operator at '\0' is invalid.
Hope this helps others out there
Cheers,
.gz
An easy way to produce a failed job:
curl -u user:password -k https://localhost:8089/services/search/jobs -d'search=| eval x'
(some types of errors fail before even turning into a job)