topic REST api no results from sid in Getting Data In

REST api no results from sid

bleung93 — Sat, 10 May 2014 07:42:25 GMT

Splunk 6.1.0 (build 206881)
Mac OSX

input:
curl -u admin:splunker -k https://localhost:8089/services/search/jobs -d'search=search index%3d"*" | stats values(sourcetype) by index'

results:
<?xml version="1.0" encoding="UTF-8"?>

1399707661.62

input:
curl -k -u admin:splunker https://localhost:8089/services/search/jobs/1399707661.62/results/ --get -d output_mode=csv

How do i get the results in the most user friendly way possible? I am currently getting back no results.

Re: REST api no results from sid

rsennett_splunk — Sat, 10 May 2014 18:27:49 GMT

You're on the right track... just perhaps, impatient! 🙂

curl -k -u admin:splunker -d 'search=search index%3d"*" | stats values(sourcetype) by index' https://localhost:8089/servicesNS/admin/search/search/jobs

produces in my case:

<response>
<sid>1399746073.348</sid>
</response>

So I issue:

curl --get -k -u admin:changed -d "output_mode=csv" -d "count=5" https://localhost:8089/servicesNS/admin/search/search/jobs/1399746073.348/results

And... low and behold I get absolutely nothing. Why? The job isn't finished running...
you need to check on that... eventually, you'll get a response back in csv format to the stdout

Take a look here... everything you want is explained:

REST tutorial

Re: REST api no results from sid

bleung93 — Sun, 11 May 2014 18:34:10 GMT

Thanks you for the response, I will be doing my research into this. Will test out tonight.

Re: REST api no results from sid

Ravimrawi — Wed, 20 Apr 2016 15:12:02 GMT

I'm not getting sid when I curl splunk API. Please assist

Expected output

1258421375.19

Actual output

curl -s -k -u 'hdcauser:hdcauser123' -o - https://splunkapi.homedepot.com:8089/services/search/jobs -d "search+${ENCODED_QRY}"|head

https://xxxxxxxxx.xxxxxxxxx.com:8089/services/search/jobs
2016-04-20T11:07:18-04:00

<name>Splunk</name>