How to enable REST endpoints so that users can use other tools to grab data from Splunk?

kteng2024 — Tue, 23 May 2017 17:11:24 GMT

How to enable REST endpoints so that users can use other tools to grab data from Splunk? Port 8089 is already opened. But when i paste the search head URL along with port number, all i could see HTML data but not the JSON data from Splunk.

Re: How to enable REST endpoints so that users can use other tools to grab data from Splunk?

vasanthmss — Tue, 23 May 2017 17:38:50 GMT

try to add the query parameter with output_mode=json.

https://<yourhost>:<mgnt_port>/.../../..?output_mode=json

Read this, http://docs.splunk.com/Documentation/Splunk/6.6.0/RESTTUT/RESTsearches

You can return search results in JSON, CSV or XML by setting the output_mode parameter. By default, results are returned in XML format.

For example, to retrieve search results in JSON format, make the following call.

Note: The curl listing includes --get because you are passing a parameter to a GET operation.

curl -u admin:changeme \
     -k https://localhost:8089/services/search/jobs/1258421375.19/results/ \
     --get -d output_mode=json

topic How to enable REST endpoints so that users can use other tools to grab data from Splunk? in Getting Data In

How to enable REST endpoints so that users can use other tools to grab data from Splunk?

Re: How to enable REST endpoints so that users can use other tools to grab data from Splunk?