Getting Data In

Issues with API using curl - "Method not allowed"

msarro
Builder

I am just starting to dabble with the splunk API. I am following the examples shown in the splunk documentation. The following command gives the following results:

[root@splunk-serv ~]# curl -u admin:changeme -k https://localhost:8089/services/search/jobs/1299860329.83/results/ -d"output_mode=csv"
<?xml version='1.0' encoding='UTF-8'?>
<response><messages><msg type='FATAL'>Method Not Allowed</msg></messages></response>

Can anyone provide any pointers on why everything else in the documentation seems to work alright, but this doesn't? Am I querying incorrectly?

Tags (1)

jsperry
Engager

so I've been playing with this, and found that if you add -G to the command, it will work.

man curl:
-G/--get
When used, this option will make all data specified with -d/--data or --data-binary to be used in a HTTP GET request instead of the POST request that otherwise would be used. The data will be appended to
the URL with a '?' separator.

Stephen_Sorkin
Splunk Employee
Splunk Employee

The problem is that using -d"..." causes curl to POST, rather than GET, the resource, which is disallowed from the REST perspective. It should work if you use GET arguments:

curl -u admin:changeme 'https://localhost:8089/services/search/jobs/1299860329.83/results?output_mode=csv'

Stephen_Sorkin
Splunk Employee
Splunk Employee

If that response is empty, that means that the search job had no results. What if you ask for the XML version of the results?

0 Karma

msarro
Builder

When I try this from the command line I get an error stating that the site certificate isn't correct. When I add the --insecure flag, it simply returns to the command prompt.

[root@splunk-serv ~]# curl -u admin:changeme --insecure 'https://localhost:8089/services/search/jobs/1300110780.86/results?output_mode=csv'
[root@splunk-serv ~]#

Going to the same URL via a browser simply shows a blank screen.

0 Karma

msarro
Builder

So the actual documentation is incorrect then? If so I'll submit a support ticket. It seems like a pretty big flaw.

0 Karma
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...