Getting Data In

accessing saved report data in json/xml from Splunk RESTful API

tommyp1972
New Member

I have tried to access a saved report through a browser URL using Splunk's RESTful API. I cannot seem to accomplish this. I am using my_domain:8089/servicesNS/my_user/my_app/ but from there I am lost. Where are the reports in the endpoints? I can't find anything in the documentation. I am using Splunk 4.3.6

Tags (3)
0 Karma

Neeraj_Luthra
Splunk Employee
Splunk Employee

All the end points are available on Splunk docs at http://docs.splunk.com/Documentation/Splunk/4.3.6/RESTAPI/RESTlist. A couple that you might find useful from this list - saved/searches/{name} and search/jobs/{search_id}/results.

We also have SDKs in 6 different languages. They make it much easier to hit these endpoints and get data from searches and reports from Splunk. You can can find more about the SDKs at http://dev.splunk.com/view/sdks/SP-CAAADP7.

Neeraj_Luthra
Splunk Employee
Splunk Employee

I don't think 4.x supports these but with 5.x and higher, following 2 URLs can be used from the browser for a quick check.

https://localhost:8089/services/search/jobs/oneshot?search=search%20index%3D_internal%20head%201

OR
https://localhost:8089/services/search/jobs/export?search=search%20index%3D_internal%20head%201

0 Karma

tommyp1972
New Member

OK. Thanks. I was just trying to access the report/saved search via the browser, not curl or php or whatever. Can this not be done just as a quick proof of concept? I found the saved search, not report, from your information above. However, it apepars that that is just to see the configuration or delete it or whatever. I just want the search's output. So I saw this->search/search/jobs/export/ . . . I just don't know how to feed it my search string. I see that your documentation provides Curl examples. But again I just want to do this in a browser with a http request.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...