topic Re: REST API oneshot blocking saved search in Getting Data In

REST API oneshot blocking saved search

leecaf — Mon, 29 Apr 2013 10:31:41 GMT

EDIT:
I've gotten some help from Splunk support team and now can get oneshot blocking calls working using the url below:

https://localhost:8089/services/search/jobs?exec_mode=oneshot&output_mode=json&search="search index=_internal | head 10"

however it is unclear to me how I would invoke a oneshot REST call to a saved service. I'm guessing it would look something like the url below but haven't had any success after playign with a few combinations usually a '404 not found':

https://localhost:8089/saved/searches/{name}?exec_mode=oneshot&output_mode=json

can someone help please?

The eventual goal is to be able to import data from splunk into Excel much like how a CSV would be imported.

Re: REST API oneshot blocking saved search

dart — Mon, 28 Sep 2020 13:47:58 GMT

You might find the OData for Splunk app to be a better option.

However, to answer your question, it's hard to see from the data you have supplied. It looks like you have "search=index=_internal |head 5", where you would want search index=_internal | head 5 as the specific error message is saying it's missing a search command (i.e. search) before a quote mark.

Re: REST API oneshot blocking saved search

leecaf — Mon, 29 Apr 2013 12:28:21 GMT

Thanks, emailed dev for OData.
corrected typo in my original post but still getting same error

Re: REST API oneshot blocking saved search

leecaf — Wed, 22 May 2013 09:09:09 GMT

I've tried OData many thanks to Neeraj Luthra. but I'm what I'm trying to do probably doesn't require OData. The problem I'm facing is while OData works nicely out of the box, excel parses the XML it generates in a very verbose manner giving me much more data than I need. I'd rather not have to debug that side of things if Splunk REST API will do the trick for me.

Re: REST API oneshot blocking saved search

Flynt — Tue, 11 Jun 2013 16:59:23 GMT

What about calling the saved search via the search command itself from the CLI? IE

curl -k -u admin:changeme -d 'search="savedsearch \"Errors in the last 24 hours\""' -d "output_mode=json" -d "exec_mode=oneshot" https://localhost:8089/servicesNS/admin/search/search/jobs/export