topic Re: Splunk API paging in Getting Data In

Splunk API paging

Zambonilli — Mon, 27 Jun 2011 20:01:43 GMT

I'm running into an issue with using the Splunk API and it only returning 30 records. I've searched the Splunk API, ATOM and opensearch documentation and I am still unable to determine how to page the records.

For example I am querying to get the current data inputs by calling https://%basesplunkurl%:8089/services/data/inputs/monitor

This returns a document with 30 records and the opensearch fields indicating that there is 34 records total.

opensearch:totalResults34/opensearch:totalResults
opensearch:itemsPerPage30/opensearch:itemsPerPage
opensearch:startIndex0/opensearch:startIndex

What do I have to do to get the next page of results? In this example the last 4 data input records?

Re: Splunk API paging

Zambonilli — Mon, 27 Jun 2011 20:40:07 GMT

So I used the web console and the splunkd_access.log file to figure out that the requests to these objects uses the opensearch REST parameters.

I changed my url to include a trailing ?count=-1 to return all records.

EX:
https://%basesplunkurl%:8089/services/data/inputs/monitor?count=-1

Re: Splunk API paging

itay — Tue, 26 Jul 2011 23:54:25 GMT

In general, you can use the offset parameter to get the next offset of results. So in your case, you'd pass in offset=30.