topic Re: Doing search through REST API using PostMan giving [Error in 'SearchParser'] in Getting Data In

Doing search through REST API using PostMan giving [Error in 'SearchParser']

ebeid — Thu, 07 Dec 2017 23:29:28 GMT

same query return results on Splunk web interface.

Re: Doing search through REST API using PostMan giving [Error in 'SearchParser']

damien_chillet — Fri, 08 Dec 2017 10:36:16 GMT

You should try removing the quotes,

Posting a job using SDK, the POST data looks as following:

search=search+index%3D_internal+component%3D%2A

(Special characters are URL encoded - no quotes)

Re: Doing search through REST API using PostMan giving [Error in 'SearchParser']

ebeid — Mon, 11 Dec 2017 16:44:35 GMT

@damien_chillet any idea how to provide time frame for the search ? and export format ?

Re: Doing search through REST API using PostMan giving [Error in 'SearchParser']

damien_chillet — Tue, 12 Dec 2017 11:15:44 GMT

Example below to export results in JSON:

POST /services/search/jobs/export HTTP/1.1

   output_mode=json&segmentation=none&latest_time=2017-12-12T00%3A00%3A00.000&earliest_time=2017-12-11T00%3A00%3A00.000&search=search+index%3D_internal+component%3D%2A+%7C+head+100

Re: Doing search through REST API using PostMan giving [Error in 'SearchParser']

vlsnkakitha — Wed, 31 Mar 2021 10:11:14 GMT

iam able to invoke login API from postman and getting session key as XML response.

but when i invoke create search API with that session key in request header and search query in request body, giving HTTP 200 response but no search id is created. getting some html content like "Splunk relies on javascript to function properly. please enable and reload the page". how to resolve this error and get the searchid created