Why REST API in SPLUNK return less data compare to data return directly from the URL

psneo — Tue, 29 Sep 2020 20:39:55 GMT

Hi,

I used following command to get the computer related detail:
https://myserver:port_num/api/sam/computer_systems?columns[]=computer_id&columns[]=host_name&columns[]=ip_address&columns[]=partition_cores&columns[]=hardware_serial_number&columns[]=server_cores&columns[]=processor_brand_string&columns[]=processor_vendor&columns[]=processor_brand&columns[]=processor_type&columns[]=processor_model&columns[]=server_processors&columns[]=server_cores&columns[]=pvu_per_core&token=9d23c5ccb3b5a5cb3284bbcda58e20ea9f15e9c5

I have configured the same command into REST API in SPLUNK as app_rest1 . When I run it under Search source="rest://app_rest1", the result or the row is much more lesser. Let say I have 500 computer related information return from the URL, I expect the same, however it only return about 30 computer in SPLUNK.

Is there any other setting that I need to configure ?

Re: Why REST API in SPLUNK return less data compare to data return directly from the URL

valiquet — Fri, 21 Dec 2018 19:29:01 GMT

Try:
|REST /servicesNS/-/-/....

Or Splunk_server=local

topic Why REST API in SPLUNK return less data compare to data return directly from the URL in Getting Data In

Why REST API in SPLUNK return less data compare to data return directly from the URL

Re: Why REST API in SPLUNK return less data compare to data return directly from the URL