topic REST API Specific Search in Getting Data In

REST API Specific Search

domtheluck — Tue, 29 Jan 2013 20:33:04 GMT

Hi,

I try to do a search with Splunk REST API from a C# client.

I need to search some general term but I need to specify some information like the host, index etc.

Here is my query:

url:
https:1.1.1.1:8089/services/search/jobs

Args in request body:
search=search SOMETERMTOSEARCH host=HOSTNAMETOSEARCHWITHIN

Right now, it work if I specificy only the SOMETERMTOSEARCH. If I add the host=HOSTNAMETOSEARCHWITHIN, Splunk truncated it to search=search SOMETERMTOSEARCH host=. Same thing if I add index=MYINDEXNAME.

How can I specify these extra parameters?

i try to add them as arguments like earliest_time or latest_time but it's not work either.

Can someone help me?

Re: REST API Specific Search

psanford_splunk — Wed, 30 Jan 2013 04:31:18 GMT

Hi - We will be releasing our C# SDK shortly and that should be able to help you. We can give you pre-release access now. Just send an email to: devinfo@splunk.com with your GitHub ID and we will get you access.

Re: REST API Specific Search

domtheluck — Wed, 30 Jan 2013 13:52:05 GMT

Thanks for your quick answer!

I will contact you shortly with my GitHub ID.

Re: REST API Specific Search

ugavnholt — Sun, 10 Feb 2013 23:17:25 GMT

It sounds like you should urlEncode the portion of the string that are a value, ie:
"search=" + UrlEncode("search SOMETERMTOSEARCH host=HOSTNAMETOSEARCHWITHIN")