topic Splunk using rest api to fetch app name / id in Getting Data In

Splunk using rest api to fetch app name / id

Dawson014 — Wed, 27 Jun 2018 13:21:28 GMT

Hello fellow Splunkers,

I am using the following query to fetch the splunk app name in standalone search head -

| rest /services/search/jobs splunk_server=local 
| addinfo 
| where sid = info_sid 
| rename eai:acl.app as app_name
| fields + app_name

However, this same query is not working in SHC. It shows No results found
Any suggestions would be appreciated.

Thanks!

renjith_nair — Wed, 27 Jun 2018 13:42:17 GMT

Hi @Dawson014,
Try running just | rest /services/search/jobs and see if it works

Dawson014 — Wed, 27 Jun 2018 13:48:07 GMT

Tried this, worked once. Then again the same No Results founds

sdawsonkg — Fri, 20 Jul 2018 10:55:37 GMT

If you're running the query on a dashboard then this should work -

<your_base_query>
| eval app_name = $env:app$
| ...

However, this will not work if you are running the query on a search panel.

Dawson014 — Fri, 20 Jul 2018 10:57:03 GMT

This will do. Thanks!

sdawsonkg — Fri, 20 Jul 2018 10:57:48 GMT

Good. Cheers!