topic Re: REST API CALL in Splunk Enterprise

REST API CALL

VijaySrrie — Mon, 29 Jun 2020 09:15:41 GMT

How to set time range using REST API call

Re: REST API CALL

anilchaithu — Mon, 29 Jun 2020 13:32:04 GMT

@VijaySrrie

Can you provide more details?

Re: REST API CALL

VijaySrrie — Thu, 02 Jul 2020 08:51:27 GMT

1. If suppose I need to view some particular index logs in putty, how to write a curl query ?

2. Question no. 1 should be seen for every 15 mins

For Question 1, I used below query but getting error (>This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required.)

curl -u adminuserid:password -k https://splunk.com/app/search/search?sid=gave that job id which we see in splunk

u = user id

k= ???

Re: REST API CALL

isoutamo — Thu, 02 Jul 2020 15:14:44 GMT

With REST you couldn’t give time, it just give what is status on time of query. If needed old events then you must try to found those from _introspection.

-k means trust non official CA signed ssl/toss cert.

r. Ismo

Re: REST API CALL

VijaySrrie — Fri, 03 Jul 2020 11:40:09 GMT

May I know how to write CURL command for a particular saved search called advanced_automation

I am using below command, where I am getting error as no such saved search.

curl -k -u admin:password -d "search=savedsearch advanced_automation" https://localhost:8089/services/search/jobs/

Re: REST API CALL

isoutamo — Fri, 03 Jul 2020 16:53:07 GMT

You could follow the next instructions https://community.splunk.com/t5/Reporting/How-to-start-a-saved-search-using-REST-API/td-p/88026
R. Ismo

Re: REST API CALL

VijaySrrie — Fri, 17 Jul 2020 09:51:35 GMT

This one worked

https://splunk-api-url:8089/servicesNS/nobody/appname/search/jobs/export?output_mode=json&segmentation=none&latest_time=2020-07-15T00%3A05%3A00.000&earliest_time=2020-07-15T00%3A00%3A00.000&search=|savedsearch%20savedsearchname%20|search%20Code=XXX-10-12