topic Re: Combining two rest services in Splunk Dev

How to combine two rest services?

pkolhatk — Wed, 16 Nov 2022 07:40:00 GMT

Hi wonderful people.

I wanted to know if we can combine two services in splunk to get an output

| rest /services/authentication/users splunk_server=local
and

| rest /services/admin/SAML-groups splunk_server=local

how can I combine the above two to get the results in one query

Re: Combining two rest services

richgalloway — Wed, 16 Nov 2022 01:38:04 GMT

It's not possible to create a single rest command that performs both actions. You can, however, use the append command to combine the results of both commands then use stats to group them.

Re: Combining two rest services

ahhloy — Fri, 06 Oct 2023 03:06:11 GMT

Hi everyone, I tried combining two REST command by using append. However it does not work.

The first rest command , I would need to get info on who is the Search Head captain, and the 2nd rest command I would need to get the bundle replication file size from the search head captain to display the bundle size. Hope some one can assist. Thank you.

| rest splunk_server=local /services/shcluster/captain/info
| fields Captain
| rename label as Captain
| append [ rest splunk_server=Captain /services/search/distributed/bundle-replication-files ]
| eval timestamp=strftime(timestamp,"%m/%d/%y %H:%M:%S")
| eval size=size/1024/1024/1024
| table filename timestamp size

Re: Combining two rest services

VatsalJagani — Fri, 06 Oct 2023 05:28:10 GMT

@ahhloy - The append command does not combine the results, it generates two different results and append. To combine it you need to use the stats command after append. See the last line in the answer from @richgalloway

Re: Combining two rest services

PickleRick — Fri, 06 Oct 2023 06:11:01 GMT

Another thing - if you want to find which server is captain to dynamically decide to which server you should send the next rest call, you can't just say splunk_server=Captain. That would be looking for a server called Captain which you most probably don't have.

You need to use one of the two possible techniques here - map command or subsearch.

Re: Combining two rest services

ahhloy — Fri, 06 Oct 2023 08:23:03 GMT

@VatsalJagani thank you for the advise.. Not sure if the use of stats command is correct.

I would need the append output to show the search head captain, bundle size and file name.