topic Re: In search results, why is API ignoring the count parameter? in Getting Data In

In search results, why is API ignoring the count parameter?

kleszczynski — Wed, 03 Oct 2018 15:18:50 GMT

I'm using API call to retrieve results of the job search/jobs/{search_id}/results.

I'm running the following command:

curl -u admin:password -k "https://<HOST>/rest/services/search/jobs/<JOB_NUMBER>/results?count=1&output_mode=json"

But, no matter what, when I put for count param (0, 1, "asadafa", etc.) I get 100 events (which is default value).

Can there be some Splunk server configuration which makes the count parameter ignored? When I run the query on other Splunk instance it works as expected.

Splunk version: 6.6.6
The server which I'm trying connect to has an endpoint https://<HOST>/rest, which probably redirects to Splunk management API port.

Re: In search results, why is API ignoring the count parameter?

VatsalJagani — Wed, 03 Oct 2018 18:24:57 GMT

Hi @kleszczynski, Can you try adding count and output_mode=json into data option in curl?

Re: In search results, why is API ignoring the count parameter?

kleszczynski — Wed, 03 Oct 2018 19:44:41 GMT

Do you mean -d count=1 -d output_mode=json? I've already tried it - the issue remains the same.

Re: In search results, why is API ignoring the count parameter?

VatsalJagani — Thu, 04 Oct 2018 05:51:07 GMT

Hi @kleszczynski,
Can you try max_count option while creating search (not while getting the result)?

Re: In search results, why is API ignoring the count parameter?

harsmarvania57 — Thu, 04 Oct 2018 08:58:12 GMT

Can't you connect directly on splunk management port instead of redirecting from https://<HOST>/rest

I am using below command on SPlunk 7.1.2 and it is returning all values (I have more than 3K events in results and all returning in JSON)

curl -k -u admin:password "https://<SPLUNK_SERVER>:8089/services/search/jobs/<JOB_ID>/results?count=0&output_mode=json"