topic Re: splunk-utils/search: GetData API Version undefined in Splunk Dev

Fix error in splunk-utils/search: GetData API Version undefined?

ohbuckeyeio — Wed, 15 Feb 2023 15:35:05 GMT

Hello,

I am using the splunk-utils SDK to try and search Splunk 9.0.4 from an external app. I am able to submit an initial search with a bearer token and can see my local instance receiving it and returning a search SID. However, when I try to retrieve the results with getData, I get an error saying "Invalid Version: undefined"

// https://splunkui.splunk.com/Packages/splunk-utils/Search const n = await getData( sid, "results", { output_mode: "json_cols" }, { splunkdPath: serverURL, app: "myapp", owner: "nobody"}, headers )

Tracing the node_modules, I can see that the getData in search.js is trying to figure out the version, but I am not following how. This seems to be the line that is determining if v2 should be used:

// Use V2 endpoints only where available // https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#Semantic_API_versioning var V2_ENDPOINTS = ['results', 'results_preview', 'events']; var endpointVersion = V2_ENDPOINTS.includes(endpoint) && gteSplunkVersion(_config.versionLabel, '9.0.2', '9.0.2209') ? '/v2' : '';

I have been looking at this example from @ryanoconnor and @nhaq but am not seeing how the right API version is being determined.

https://github.com/splunk/react_search_example/blob/main/src/App.js

Any ideas how to update my call to tell my getData what version to use? I am assuming this is unhappy about a missing version but maybe it's something else...

Full Error:

index.js:1 TypeError: Invalid Version: undefined at new SemVer (semver.js:19:1) at patch (patch.js:2:1) at gteSplunkVersion (search.js:53:1) at getData (search.js:326:1) at loadResults (splunksearch.js:80:1) at retrieveJob (splunksearch.js:56:1)

Re: splunk-utils/search: GetData API Version undefined

ohbuckeyeio — Wed, 15 Feb 2023 05:18:43 GMT

Adding additional information.

Looking further at the search.js's getData implementation, I might have a versioning issue happening with my splunk-utils package. The notes for getData suggest it is doing a GET:

https://splunkui.splunk.com/Packages/splunk-utils/Search

Makes a GET request to the search/${endpointVersion}/jobs/${search_id}/${endpoint} REST API endpoint to get data from the specified search job.

My version of the package is doing a POST. These changes appear to have been pushed in the last few weeks according to the change log.

if (parameters.search && endpointVersion === '/v2') { return fetch(url, _objectSpread(_objectSpread({}, baseFetchInit), {}, { method: 'POST', body: qs })).then((0, _fetch.handleResponse)([200, 204]))["catch"]((0, _fetch.handleError)("Failed to get ".concat(endpoint || 'status', " for job ").concat(sid))); }

Re: splunk-utils/search: GetData API Version undefined

ohbuckeyeio — Wed, 15 Feb 2023 05:34:55 GMT

Sure enough, downgrading to version 2.2.4 fixed my issue. There must be something fundamentally different with the latest 2.3.1 version that is not playing well with an externally-based application calling Splunk.

npm install @splunk/splunk-utils@"2.2.4"

The 2.3.1 version appears to be reliant on the Config package, but running outside of a Splunk environment, I do not see how it is possible to gather those facts and the documentation on this endpoint is lacking.

https://splunkui.splunk.com/Packages/splunk-utils/Config

Does the 2.3.1 version of getData require a cookie instead of a bearer token in a header? What am I missing? I might need to move this to a case with Splunk.

Re: splunk-utils/search: GetData API Version undefined

pgoldweic — Tue, 10 Sep 2024 18:31:19 GMT

Hi @ohbuckeyeio , I'm just curious; did you ever get a response from Splunk on this? I'm finding other problems with my users of splunk-utils and wonder whether more recent versions are safe to use or not.

Re: splunk-utils/search: GetData API Version undefined

pgoldweic — Tue, 10 Sep 2024 18:39:17 GMT

Re: splunk-utils/search: GetData API Version undefined

ohbuckeyeio — Tue, 10 Sep 2024 18:43:21 GMT

Hi @pgoldweic - I did not receive a response back. I was told to email the dev team's support directly:

webplatform@splunk.com

or hit up their Slack channel: #webplatform