Is there a programmatic way of finding the sum of events returned from a search via REST API?

[geordieguy]

Hi Folks,

Just getting started trying to figure out the API. My mission which I have chosen to accept is to report on how many events are returned from a search, from yesterday, each morning at open of business. I have a search;

> <search>
>           <query>username@domain.com.au
> sourcetype="MSExchange:2010:MessageTracking"
> sender_username=username</query>
>           <earliest>-1d@d</earliest>
>           <latest>@d</latest> ...

Which is returning all the appropriate results, but is there a way to programatically grab the count of results via the API?

[ryanoconnor · Accepted solution]

Once the search runs you should be able to query the REST API to find the job and grab that information: http://docs.splunk.com/Documentation/Splunk/6.4.1/RESTREF/RESTsearch#search.2Fjobs

In addition, you could also append "| stats count" to the end of your current query and that would return just a numerical value of a count of the events returned by your search.

[ryanoconnor]

/search/jobs will give you information about all search jobs and you could filter from there.

You could also hit /search/jobs/{search_id}/timeline and you'll return a parameter for event count.

[geordieguy]

Thanks, does that mean I should GET /search/jobs//eventCount ? or do I get /search/jobs/id and eventCount is an XML element in the response which I parse?