topic Re: Splunk API, curl and php in Getting Data In

Splunk API, curl and php

rzjac — Fri, 25 Jun 2010 05:25:14 GMT

I'm trying to get partial results having a job id through REST API how can i do it?

I'm using curl and php.

Thank you

Re: Splunk API, curl and php

Lowell — Fri, 25 Jun 2010 05:36:14 GMT

What do you mean by "partial" results? Like a subset? You have to pull the events or results back in chunks at a time so you can just pull a few times and then stop when you have enough data. (Thought it may be a better option to limit your search with | head 1000 or something)

Re: Splunk API, curl and php

rzjac — Fri, 25 Jun 2010 05:44:51 GMT

I'd like to pull results as they arrive. Like on the web interface for splunk. I don't want to wait till whole job is finished.

Re: Splunk API, curl and php

rroberts — Fri, 06 Aug 2010 20:02:29 GMT

What Splunk version are you on?

Re: Splunk API, curl and php

rroberts — Sat, 07 Aug 2010 04:47:22 GMT

There are PHP examples you might find useful here...

http://code.google.com/p/splunk-php-sdk/source/browse/trunk/Search.php

 * Retrieves a list of search jobs on the server.
 * 
 * @param bool $as_objects If TRUE, returns an array of Splunk_Search_Result
 *     objects instead of an array of associative arrays.
 * @param string $result_class If $as_objects is true, use this class name
 *     to instantiate the search result objects for each job.
 * @return mixed Array on success, FALSE on failure
 * @access public
 */
public function listJobs($as_objects = false, $result_class = 'Splunk_Search_Result')
{
    $result = $this->send('/services/search/jobs', null, 'GET');
    if (! $this->last_successful) {
        return false;
    }