topic How read the data from splunk using search query using postman (not curl )get reuest. in Getting Data In

How read the data from splunk using search query using postman (not curl )get reuest.

kadamshridhar01 — Sat, 29 Dec 2018 11:00:02 GMT

I want to know using postman how can find the result of below query
sourcetype="httpevent" 69272d19-53a9-4539-b149-9fc46bbc73cf

please find the attached image

Re: How read the data from splunk using search query using postman (not curl )get reuest.

niketn — Sat, 29 Dec 2018 13:52:36 GMT

@kadamshridhar01 sorry your question is not clear. Do you need help with sending data through HEC (via Postman) to Splunk? Or you are already sending data to Splunk and need help with writing SPL?

Re: How read the data from splunk using search query using postman (not curl )get reuest.

kadamshridhar01 — Sun, 30 Dec 2018 12:16:49 GMT

@niketnilay .Already data present in splunk .i want to retrieve it through postman with search criteria .I am new to splunk .what is SPL ?
If you give me below details retrieve data from splunk.
1)Request type (get/post) and url(https://localhost:8089/?)
2)request body if any require and format
3)headers list with value .

Currently i am able to hit request splunk using basic auth but I don't understand how to set search criteria to get data

Re: How read the data from splunk using search query using postman (not curl )get reuest.

petom — Wed, 02 Jan 2019 07:13:57 GMT

There is a pretty good documentation available on Splunk website related to Splunk REST API.
You might want to have a look at it. The link below is related to Search endpoint:
https://docs.splunk.com/Documentation/Splunk/7.2.3/RESTREF/RESTsearch

But basically what you need is:
1) url is https://splunkserver:8089/services/jobs/export (export - to export search results, there are other search endpoints available too)
2) use basic authentication with your login name and password
3) method either POST or GET (see the docs), but let's say you use POST
4) as request parameters (key / value pairs in Params tab in Postman) use (note, colon below is a separator between key and value):

earliest_time :  -1h   (last 1 hour)
latest_time : now
output_mode : json  (or csv or xml, see the docs)
search : sourcetype="httpevent" 69272d19-53a9-4539-b149-9fc46bbc73cf

Results of the query will be in the format you specified in output_mode parameter.