Getting Data In

Splunk Rest API: How to pass parameters in search

vaibhavagg2006
Communicator

HI,
I have an requirement to create splunk rest api which can accept inputs and pass it to the search. Search will accept the parameters and generate the results. API should send back the results. Also how can I manage authentication in this. Please provide me the pointers for the same.

Tags (2)
0 Karma

jkat54
SplunkTrust
SplunkTrust

First you'll want to get a sessionid from the auth endpoints.

Second you'll want to execute a search from the search endpoints and record the search id. This will require the sessionid.

Then you'll want to get the results from the search endpoints after verifying the search has completed. Both steps here will require the search id & sessionid.

There's plenty of documentation on the Splunk rest api. There is no need to create your own api.

http://dev.splunk.com/restapi

As we aren't in the business of writing your code for you, I hope you can use a search engine to fill in the blanks.

Best of luck! Let us know if you have difficulties with the api.

0 Karma

vaibhavagg2006
Communicator

Hi
Thanks for your inputs. I am looking for an endpoint through which I can pass parameters to my search. Can we call a macro using rest api.

0 Karma

neeldesai1992
Path Finder

did you get the answer of this question?

0 Karma

jkat54
SplunkTrust
SplunkTrust

Absolutely. You'd have to escape the single quotes on the Marco but you can do this via the search endpoints.

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...