Splunk 6.1.0 (build 206881)
Mac OSX
input:
curl -u admin:splunker -k https://localhost:8089/services/search/jobs -d'search=search index%3d"*" | stats values(sourcetype) by index'
results:
<?xml version="1.0" encoding="UTF-8"?>
input:
curl -k -u admin:splunker https://localhost:8089/services/search/jobs/1399707661.62/results/ --get -d output_mode=csv
How do i get the results in the most user friendly way possible? I am currently getting back no results.
You're on the right track... just perhaps, impatient! 🙂
curl -k -u admin:splunker -d 'search=search index%3d"*" | stats values(sourcetype) by index' https://localhost:8089/servicesNS/admin/search/search/jobs
produces in my case:
<response>
<sid>1399746073.348</sid>
</response>
So I issue:
curl --get -k -u admin:changed -d "output_mode=csv" -d "count=5" https://localhost:8089/servicesNS/admin/search/search/jobs/1399746073.348/results
And... low and behold I get absolutely nothing. Why? The job isn't finished running...
you need to check on that... eventually, you'll get a response back in csv format to the stdout
Take a look here... everything you want is explained:
REST tutorial
You're on the right track... just perhaps, impatient! 🙂
curl -k -u admin:splunker -d 'search=search index%3d"*" | stats values(sourcetype) by index' https://localhost:8089/servicesNS/admin/search/search/jobs
produces in my case:
<response>
<sid>1399746073.348</sid>
</response>
So I issue:
curl --get -k -u admin:changed -d "output_mode=csv" -d "count=5" https://localhost:8089/servicesNS/admin/search/search/jobs/1399746073.348/results
And... low and behold I get absolutely nothing. Why? The job isn't finished running...
you need to check on that... eventually, you'll get a response back in csv format to the stdout
Take a look here... everything you want is explained:
REST tutorial
I'm not getting sid when I curl splunk API. Please assist
Expected output
1258421375.19
Actual output
curl -s -k -u 'hdcauser:hdcauser123' -o - https://splunkapi.homedepot.com:8089/services/search/jobs -d "search+${ENCODED_QRY}"|head
https://xxxxxxxxx.xxxxxxxxx.com:8089/services/search/jobs
2016-04-20T11:07:18-04:00
<name>Splunk</name>
Thanks you for the response, I will be doing my research into this. Will test out tonight.