topic Splunk Rest API: How to pass parameters in search in Getting Data In

Splunk Rest API: How to pass parameters in search

vaibhavagg2006 — Thu, 24 Mar 2016 20:33:18 GMT

HI,
I have an requirement to create splunk rest api which can accept inputs and pass it to the search. Search will accept the parameters and generate the results. API should send back the results. Also how can I manage authentication in this. Please provide me the pointers for the same.

Re: Splunk Rest API: How to pass parameters in search

jkat54 — Thu, 24 Mar 2016 21:20:41 GMT

First you'll want to get a sessionid from the auth endpoints.

Second you'll want to execute a search from the search endpoints and record the search id. This will require the sessionid.

Then you'll want to get the results from the search endpoints after verifying the search has completed. Both steps here will require the search id & sessionid.

There's plenty of documentation on the Splunk rest api. There is no need to create your own api.

http://dev.splunk.com/restapi

As we aren't in the business of writing your code for you, I hope you can use a search engine to fill in the blanks.

Best of luck! Let us know if you have difficulties with the api.

Re: Splunk Rest API: How to pass parameters in search

vaibhavagg2006 — Wed, 11 May 2016 18:25:28 GMT

Hi
Thanks for your inputs. I am looking for an endpoint through which I can pass parameters to my search. Can we call a macro using rest api.

Re: Splunk Rest API: How to pass parameters in search

jkat54 — Wed, 11 May 2016 19:19:15 GMT

Absolutely. You'd have to escape the single quotes on the Marco but you can do this via the search endpoints.

Re: Splunk Rest API: How to pass parameters in search

neeldesai1992 — Fri, 13 Oct 2017 18:24:06 GMT

did you get the answer of this question?