topic Re: Why does a search with inputlookup work when used in Splunk Web, but returns no results when using the REST API? in Getting Data In

Why does a search with inputlookup work when used in Splunk Web, but returns no results when using the REST API?

mohankesireddy — Thu, 05 Mar 2015 18:27:13 GMT

"inputlookup" command works fine when I use in Splunk UI, but same search comes back with no results when I search through REST API:

curl -w "@curl-format.txt" -s -k -u admin:changes  https://localhost:8089/servicesNS/admin/search/search/jobs -d search="| inputlookup lookupdefinition” -d output_mode=json

Re: Why does a search with inputlookup work when used in Splunk Web, but returns no results when using the REST API?

mohankesireddy — Tue, 10 Mar 2015 21:21:01 GMT

found the issue, its not the issue with REST API but permissions. the lookup permissions are constrained to an app context and the REST search using a different app context.

# curl -ku user:support https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="| inputlookup ip2internalhostname" -d output_mode=json
{"preview":false,"offset":0,"lastrow":true,"result":{"hostname":"big","src":"0.0.0.0"}}