topic Executing search query on a remote Splunk Instance, may be using REST command or Command line in Getting Data In

Executing search query on a remote Splunk Instance, may be using REST command or Command line

somesoni2 — Thu, 31 Oct 2013 20:12:01 GMT

Hi,
I have a requirement to execute a query on different SPlunk instances (different environmet). Adding them as search peer is not an options (limitation), hence I was wondering if we have any options, either REST command or using command line, to execute a search on a remote Splunk instance and get the search result.

If it can be done by REST, I may be able to automate the same.

Thanks in advanced.

Re: Executing search query on a remote Splunk Instance, may be using REST command or Command line

Ayn — Thu, 31 Oct 2013 20:22:20 GMT

What exactly is the limitation that makes you unable to add the remote instances as search peers? The search head will be communicating with its search peers solely through the REST API, so...

Otherwise you could either query the remote instance simply by issuing a search through the splunk CLI, by adding the uri parameter:

$SPLUNK_HOME/bin/splunk search 'yoursearch' -uri 'https://remoteinstance:8089/'

Or you could use one of the existing SDK's to issue searches via the REST API.

Re: Executing search query on a remote Splunk Instance, may be using REST command or Command line

Damien_Dallimor — Thu, 31 Oct 2013 20:23:32 GMT

This can certainly be accomplished via the Splunk REST API.

And we have several language SDKs with comprehensive searching examples to make it easier to do this.

Re: Executing search query on a remote Splunk Instance, may be using REST command or Command line

shivarpith — Thu, 26 May 2016 22:47:03 GMT

how do i export the above results to a text or csv?

Re: Executing search query on a remote Splunk Instance, may be using REST command or Command line

omerl — Tue, 01 Oct 2019 17:31:55 GMT

I made a search command to do it easily.

Probably too late for this issue, but maybe someone will find it helpful and simpler than using the REST API directly:
https://github.com/omerl13/remote-splunk-search

Usage will be like:

| remote 
    host="mysplunk2.com" 
    query="index=main | head 50 | table _time host _raw" 
    username="user" 
    password="changeme"

(Tokens are also supported)